InformAction Forums

Re. "Exploiting CSRF under NoScript Conditions", found at https://community.rapid7.com/community/ ... javascript

I don't think the article is right. I did try the scenario, and NoScript did detect and did block the attempt at cross-site request. My understanding is that ABE prevents this by default (I don't remember changing anything in there), and so a user would be protected out-of-the-box, as opposed to what the article suggests. I figured Giorgio may want to clear this with the author of the article, as the article is a disservice to users by somewhat misinforming them. If I hadn't verified myself, I would have been led to the wrong conclusion (that NoScript wasn't protecting me) by the article.

I hate when they force you to both enabling JavaScript and joining the website (and filling a captcha) just to comment

ABE is only the beginning. The author also suggested bypassing NoScript using clickjacking (ClearClick handles this situation, right?), and apparently ignored the fact that NoScript sanitises POST requests sent from untrusted sites.

At least he did respond to Giorgio's comment . But it still looks like he hasn't done his homework properly regarding ClearClick and the sanitisation of untrusted POST requests.