hunt-csrf

Name: hunt-csrf
Author: elementalsouls

3.0kstars461forks

How to install hunt-csrf?

elementalsouls/claude-bughunter/hunt-csrf

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-csrf

Installs into the current project.

Summary

Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000)

Files · 1

View on GitHub

SKILL.md

1	## Shortcut: a raw HTTP client beats a real cross-origin page for header-check CSRF
2
3	A raw HTTP client (curl, Burp Repeater, any scripting client) is not a browser: it will send
4	whatever `Origin`/`Referer` header VALUE you set, from any path, on the same connection as your
5	authenticated cookie. Many apps that claim to defend against CSRF only do a naive string check
6	on the incoming `Origin`/`Referer` header (does it contain/equal some expected value?) rather than
7	real same-origin enforcement — you can satisfy that check directly by setting the header, with no
8	actual cross-site delivery (hosting an HTML page, a headless browser) required. This is faster and
9	more reliable than building a real attacker page for this exact pattern:
10	```
11	POST /profile HTTP/1.1
12	Content-Type: application/x-www-form-urlencoded
13	Origin: https://a-domain-the-app-treats-as-trusted-or-attacker-controlled.example
14	Cookie: <authenticated session>
15
16	username=csrf_poc
17	```
18	If some text names a SPECIFIC origin/domain as the "expected" attacker page, that literal value is
19	often exactly what the server's check is looking for — try it verbatim in `Origin` (fall back to
20	`Referer` if `Origin` alone doesn't flip it). Only build a real cross-origin page (actual browser
21	delivery) when the target does genuine SameSite/fetch-based origin enforcement that a spoofed header
22	can't satisfy.
23
24	## Autonomous Testing Priority
25
26	CSRF only matters on state-changing actions that a browser could be tricked into making cross-site.
27
28	Testing flow:
29	1. GET the form endpoint to establish a baseline and check what fields exist (look for hidden `csrf_token`, `authenticity_token`, `_token`, `csrfmiddlewaretoken` fields).
30	2. POST the state-changing action without any CSRF token field. Send only the functional parameters (email, amount, etc.).
31	3. Use a "simple-request" Content-Type — `application/x-www-form-urlencoded`, `multipart/form-data`, OR `text/plain` are the three CORS "simple" content-types a cross-origin form can send with no preflight. A JSON endpoint is CSRF-resistant only if the server rejects those — if it also accepts a `text/plain` body (common), craft a `text/plain` payload that parses as valid JSON (see the JSON-CSRF-via-text/plain section). Don't skip a JSON endpoint on the assumption that `application/json` alone is protective.
32	4. If the action succeeds (2xx, no "invalid token" error) → CSRF is confirmed.
33
34	High-value targets (in order of impact):
35	- Email/password change → account takeover
36	- Money transfer or payment → financial fraud
37	- Admin actions (role assignment, user deletion)
38	- OAuth social-account linking → persistent ATO
39
40	Token bypass techniques when a token IS present:
41	- Omit the token field entirely — some frameworks only validate if the field exists, not if it's absent
42	- Send an empty value (`_token=`) — some validate format, not presence
43	- Copy a token from another session — some tokens aren't tied to the session
44
45	Scope: Don't test CSRF on login forms (no existing session to exploit), logout (no real impact), or read-only GET endpoints.
46
47	---
48
49	## Crown Jewel Targets
50
51	CSRF becomes high-value when it touches state-changing actions with account-level or financial consequences. The highest-paying targets are:
52
53	- Account takeover vectors: OAuth/SSO flows (RelayState manipulation), social account linking/unlinking (Oculus-Facebook, SocialClub), import-friends features that expose OAuth tokens
54	- Authentication infrastructure: Login CSRF, session fixation via CSRF, forced account association
55	- API endpoints accepting cross-origin POST: JSON APIs, heartbeat/activity APIs, anything that skips Content-Type enforcement
56	- Third-party integrations: Grafana, monitoring dashboards, embedded analytics — often lag on CSRF protections
57	- Social platforms: Twitter/X collections, friend imports, social graph mutations — high-volume, authenticated actions with real user impact
58
59	Asset types that pay most: Core product auth flows > API gateways > third-party integrations running on subdomains > admin panels.
60
61	---
62
63	## Attack Surface Signals
64
65	### URL Patterns
66	```
67	/oauth/authorize?RelayState=
68	/accounts/l

People who liked this also viewed

6 picks

Type

hunt-csrf

3.0kstars461forks

View on GitHub

How to install hunt-csrf?

elementalsouls/claude-bughunter/hunt-csrf

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-csrf

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## Shortcut: a raw HTTP client beats a real cross-origin page for header-check CSRF
2
3	A raw HTTP client (curl, Burp Repeater, any scripting client) is not a browser: it will send
4	whatever `Origin`/`Referer` header VALUE you set, from any path, on the same connection as your
5	authenticated cookie. Many apps that claim to defend against CSRF only do a naive string check
6	on the incoming `Origin`/`Referer` header (does it contain/equal some expected value?) rather than
7	real same-origin enforcement — you can satisfy that check directly by setting the header, with no
8	actual cross-site delivery (hosting an HTML page, a headless browser) required. This is faster and
9	more reliable than building a real attacker page for this exact pattern:
10	```
11	POST /profile HTTP/1.1
12	Content-Type: application/x-www-form-urlencoded
13	Origin: https://a-domain-the-app-treats-as-trusted-or-attacker-controlled.example
14	Cookie: <authenticated session>
15
16	username=csrf_poc
17	```
18	If some text names a SPECIFIC origin/domain as the "expected" attacker page, that literal value is
19	often exactly what the server's check is looking for — try it verbatim in `Origin` (fall back to
20	`Referer` if `Origin` alone doesn't flip it). Only build a real cross-origin page (actual browser
21	delivery) when the target does genuine SameSite/fetch-based origin enforcement that a spoofed header
22	can't satisfy.
23
24	## Autonomous Testing Priority
25
26	CSRF only matters on state-changing actions that a browser could be tricked into making cross-site.
27
28	Testing flow:
29	1. GET the form endpoint to establish a baseline and check what fields exist (look for hidden `csrf_token`, `authenticity_token`, `_token`, `csrfmiddlewaretoken` fields).
30	2. POST the state-changing action without any CSRF token field. Send only the functional parameters (email, amount, etc.).
31	3. Use a "simple-request" Content-Type — `application/x-www-form-urlencoded`, `multipart/form-data`, OR `text/plain` are the three CORS "simple" content-types a cross-origin form can send with no preflight. A JSON endpoint is CSRF-resistant only if the server rejects those — if it also accepts a `text/plain` body (common), craft a `text/plain` payload that parses as valid JSON (see the JSON-CSRF-via-text/plain section). Don't skip a JSON endpoint on the assumption that `application/json` alone is protective.
32	4. If the action succeeds (2xx, no "invalid token" error) → CSRF is confirmed.
33
34	High-value targets (in order of impact):
35	- Email/password change → account takeover
36	- Money transfer or payment → financial fraud
37	- Admin actions (role assignment, user deletion)
38	- OAuth social-account linking → persistent ATO
39
40	Token bypass techniques when a token IS present:
41	- Omit the token field entirely — some frameworks only validate if the field exists, not if it's absent
42	- Send an empty value (`_token=`) — some validate format, not presence
43	- Copy a token from another session — some tokens aren't tied to the session
44
45	Scope: Don't test CSRF on login forms (no existing session to exploit), logout (no real impact), or read-only GET endpoints.
46
47	---
48
49	## Crown Jewel Targets
50
51	CSRF becomes high-value when it touches state-changing actions with account-level or financial consequences. The highest-paying targets are:
52
53	- Account takeover vectors: OAuth/SSO flows (RelayState manipulation), social account linking/unlinking (Oculus-Facebook, SocialClub), import-friends features that expose OAuth tokens
54	- Authentication infrastructure: Login CSRF, session fixation via CSRF, forced account association
55	- API endpoints accepting cross-origin POST: JSON APIs, heartbeat/activity APIs, anything that skips Content-Type enforcement
56	- Third-party integrations: Grafana, monitoring dashboards, embedded analytics — often lag on CSRF protections
57	- Social platforms: Twitter/X collections, friend imports, social graph mutations — high-volume, authenticated actions with real user impact
58
59	Asset types that pay most: Core product auth flows > API gateways > third-party integrations running on subdomains > admin panels.
60
61	---
62
63	## Attack Surface Signals
64
65	### URL Patterns
66	```
67	/oauth/authorize?RelayState=
68	/accounts/l

People who liked this also viewed

6 picks

Type