如何测试我的 wasp.net MVC 3 网站是否受到 CSRF 攻击
我在接受用户输入的所有视图中使用防伪造令牌 html 帮助程序，并在相关操作方法上使用 [ValidateAntiForgeryToken]，以防止任何可能的 CSRF 攻击。 但我面临的问题是如何测试这些代码行是否运行良好并且它们将防止任何可能的攻击。 BR
I am using the Anti forgery token html helper at all the views that accept user input and the [ValidateAntiForgeryToken] on the associated action methods to protect from any possible CSRF attacks.
But i am facing a problem on how i can test that these line of codes is working well and they will prevent any possible attack.
BR
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以编写一个可以在任何地方托管的静态 HTML 页面。甚至不需要网络服务器，您可以使用
file:///c:/foo.htm例如。在此 HTML 页面中创建一个简单的要了解有关 CSRF 的更多信息，请参阅以下文章。 Jeff Atwood 还 博客它。
并且不要仅仅期望您运行一些神奇的工具，它会显示绿灯或红灯。如果存在这样的工具，黑客就不会存在，因为所有网站都会受到保护，他们不会有任何东西可以黑客攻击。
确保您的网站安全的最佳方法是咨询安全专家，他们将进行广泛的审核和代码审查。
You could write a static HTML page that you could host just anywhere. Don't even need a web server, you could use the
file:///c:/foo.htmfor example. In this HTML page create a simple<form>that will contain the same input elements (same names) as some of the ASP.NET MVC views that you want to test against CSRF. Theactionof the form will point to the same action as your ASP.NET MVC views. Then submit the form. If an AntiForgeryToken exception is thrown, you are safe. If on the other hand the controller action is executed, you are vulnerable to a CSRF attack.To learn more about CSRF look at the following article. Jeff Atwood also blogged about it.
And don't just expect some miracle tool that you will run and it will show a green or red light. If such tool existed, hackers wouldn't exist, as all sites would be protected and they wouldn't have anything to hack.
The best way to ensure that your site is safe is to consult with a security specialist who will perform an extensive audit and code review.