30 lines
1.3 KiB
Bash
Executable file
30 lines
1.3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Live CSRF matrix over EVERY unsafe route of a running tmplatformd (dev-login profile).
|
|
# Usage: csrf-matrix.sh [base-url] [cookie-name]
|
|
set -u
|
|
B=${1:-http://127.0.0.1:8102}
|
|
N=${2:-__Host-tm_session}
|
|
TOK=$(curl -s --noproxy '*' -i -X POST "$B/auth/dev-login" | sed -n "s/^Set-Cookie: ${N}=\([^;]*\).*/\1/p")
|
|
[ -z "$TOK" ] && { echo "no session issued"; exit 1; }
|
|
code() { curl -s --noproxy '*' -o /dev/null -w '%{http_code}' "$@"; }
|
|
routes=(
|
|
"POST $B/v0/books/bk1/runs"
|
|
"POST $B/v0/runs/r1/stop"
|
|
"POST $B/v0/runs/r1/resume"
|
|
"POST $B/v0/books"
|
|
"POST $B/auth/logout"
|
|
"POST $B/auth/logout-all"
|
|
"POST $B/auth/dev-login"
|
|
"PUT $B/v0/books/bk1"
|
|
"DELETE $B/v0/books/bk1"
|
|
)
|
|
printf '%-34s %-9s %-9s %-9s %-9s %-9s\n' ROUTE bare +hdr xsite+h origin+h nocookie
|
|
for r in "${routes[@]}"; do
|
|
m=${r%% *}; u=${r##* }
|
|
bare=$(code -X "$m" -H "Cookie: ${N}=${TOK}" "$u")
|
|
hdr=$(code -X "$m" -H "Cookie: ${N}=${TOK}" -H 'X-TM-Client: probe' "$u")
|
|
xs=$(code -X "$m" -H "Cookie: ${N}=${TOK}" -H 'X-TM-Client: probe' -H 'Sec-Fetch-Site: cross-site' "$u")
|
|
org=$(code -X "$m" -H "Cookie: ${N}=${TOK}" -H 'X-TM-Client: probe' -H 'Origin: https://evil.example' "$u")
|
|
noc=$(code -X "$m" "$u")
|
|
printf '%-34s %-9s %-9s %-9s %-9s %-9s\n' "$m ${u#$B}" "$bare" "$hdr" "$xs" "$org" "$noc"
|
|
done
|