csrf-detect

Detect and analyze CSRF vulnerabilities with browser-based proof-of-concept requests.

Updated May 16, 2026

Search Tags:#penetration testing #web application security #csrf detection #browser-based PoC #state-changing actions

Ready to run

npx skills add https://github.com/Chid0k/claude-marketplace --skill csrf-detect

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: csrf-detect
Source: https://github.com/Chid0k/claude-marketplace/tree/main/plugins/vuln-detect-plugin/skills/csrf-detect
Command: npx skills add https://github.com/Chid0k/claude-marketplace --skill csrf-detect

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires playwright, burp-suite, local-poc-page, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This skill helps penetration testers detect Cross-Site Request Forgery (CSRF) vulnerabilities in web applications by mapping state-changing actions and evaluating browser behavior.

Core Features & Use Cases

CSRF Detection: Identifies and verifies CSRF vulnerabilities through browser-based proof-of-concept requests.
Predefined Tools and Prerequisites: Utilizes tools like Playwright and Burp Suite for comprehensive testing.
Attack Surface Mapping: Prioritizes endpoints that change user state, such as account settings, financial transactions, and security-related actions.

Quick Start

Analyze CSRF vulnerabilities in a web application by using the 'csrf-detect' skill.

Frequently Asked Questions about csrf-detect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect CSRF vulnerabilities in web applications using browser-based PoCs?▼

CSRF detection is performed by executing browser-based proof-of-concept requests against state-changing endpoints to verify Cross-Site Request Forgery vulnerabilities. It evaluates browser behavior and inspects security defenses like anti-CSRF tokens.

Do I need Playwright and Burp Suite to test for Cross-Site Request Forgery?▼

Yes, testing for Cross-Site Request Forgery requires Playwright and Burp Suite. You must also set up a local PoC page hosting environment to execute the browser-based proof-of-concept requests needed for comprehensive vulnerability analysis.

What web application endpoints should I prioritize for CSRF detection?▼

CSRF detection prioritizes endpoints that change user state, such as account settings, financial transactions, and security-related actions. Mapping this attack surface focuses vulnerability testing on functionalities most susceptible to Cross-Site Request Forgery.

How does CSRF detection inspect browser cookies and headers during penetration testing?▼

CSRF detection inspects browser cookies and headers during penetration testing by evaluating how browser-based proof-of-concept requests are transmitted. It analyzes these HTTP components to determine if state-changing actions validate session authenticity and defense mechanisms.

What is the best way to verify CSRF defenses like tokens during web application security testing?▼

The best way to verify CSRF defenses is by executing browser-based PoCs to inspect token validation, cookie configurations, and header enforcement. This confirms whether state-changing actions reject unauthorized Cross-Site Request Forgery attempts.