skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

csrf-cross-site-request-forgery

Test state-changing endpoints for CSRF weaknesses and anti-CSRF controls.

241|28|Updated May 20, 2026
Search Tags:#csrf#web security testing#sameSite#oauth state#json csrf#anti-csrf tokens#attack playbook
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill csrf-cross-site-request-forgery-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: csrf-cross-site-request-forgery
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/csrf-cross-site-request-forgery
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill csrf-cross-site-request-forgery-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you assess whether a web application is vulnerable to Cross-Site Request Forgery by guiding targeted testing of state-changing flows and the real-world weaknesses of anti-CSRF controls.

Core Features & Use Cases

  • CSRF target identification: Focuses on high-impact state-changing endpoints such as account takeover actions, privilege changes, deletions, webhook configuration, and security setting modifications.
  • Token and validation weakness checks: Evaluates missing tokens, unvalidated tokens, session/user binding flaws, static or predictable token patterns, and broken double-submit cookie implementations.
  • SameSite-aware attack scenarios: Tests practical bypass paths involving SameSite=Lax/None behavior, Lax exemption timing, redirect/method-override tricks, and subdomain XSS staging.
  • JSON and multipart CSRF techniques: Covers common edge cases for JSON CSRF, content-type downgrades, multipart-form submission behavior, and credentialed XHR requirements.
  • Chainable bypasses and combos: Includes CSRF + XSS token bypass and OIDC/OAuth state (state parameter) handling for authorization CSRF.

Quick Start

Use the csrf-cross-site-request-forgery skill against the target URL and list each state-changing endpoint you want tested, including the expected parameters, authentication context, and any observed CSRF token or SameSite cookie behavior.

Frequently Asked Questions about csrf-cross-site-request-forgery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for CSRF vulnerabilities on state-changing endpoints?▼

To test for CSRF vulnerabilities on state-changing endpoints, you target authenticated web workflows by systematically modifying or removing anti-CSRF tokens and correlating SameSite cookie attributes to generate reproducible proof-of-concept attempts.

How can I bypass SameSite cookie protections during web security testing?▼

You can bypass SameSite cookie protections by testing Lax exemption timing, redirect tricks, method-override techniques, and subdomain XSS staging paths during web security testing to validate cross-site request forgery weaknesses.

What is JSON CSRF and how does content-type affect attack scenarios?▼

JSON CSRF exploits credentialed cross-site XHR requests by leveraging content-type downgrades and multipart-form submission behavior to execute state-changing actions, bypassing standard anti-CSRF token controls.

Does this CSRF testing approach handle OAuth state parameter validation?▼

Yes, this CSRF testing approach handles OAuth state parameter validation by specifically testing OIDC and OAuth authorization flows to identify authorization CSRF weaknesses and broken state parameter requirements.

What are common anti-CSRF token weaknesses I should check for?▼

Common anti-CSRF token weaknesses include missing tokens, unvalidated tokens, session and user binding flaws, static or predictable token patterns, and broken double-submit cookie implementations across authenticated web workflows.

Related Skills

Explore More Legal & Compliance Skills→
thejefflarsonthejefflarson
20

csrf

Enforce CSRF tokens on state-changing endpoints across web frameworks.

Community
Advanced
ApegurusApegurus
1

exploit-reference

Index major DeFi exploits with vulnerability patterns and Foundry PoCs.

Community
Intermediate
blacklanternsecurityblacklanternsecurity
253

csrf

Exploits CSRF vulnerabilities in state-changing web endpoints and generates HTML PoC pages.

Official
Advanced
fatihkanfatihkan
7

sc-csrf

Detect CSRF vulnerabilities in state-changing endpoints across web frameworks.

Community
Advanced