csrf-detect

CSRF detection is performed by executing browser-based proof-of-concept requests against state-changing endpoints to verify Cross-Site Request Forgery vulnerabilities. It evaluates browser behavior and inspects security defenses like anti-CSRF tokens.

Yes, testing for Cross-Site Request Forgery requires Playwright and Burp Suite. You must also set up a local PoC page hosting environment to execute the browser-based proof-of-concept requests needed for comprehensive vulnerability analysis.

CSRF detection prioritizes endpoints that change user state, such as account settings, financial transactions, and security-related actions. Mapping this attack surface focuses vulnerability testing on functionalities most susceptible to Cross-Site Request Forgery.

CSRF detection inspects browser cookies and headers during penetration testing by evaluating how browser-based proof-of-concept requests are transmitted. It analyzes these HTTP components to determine if state-changing actions validate session authenticity and defense mechanisms.

The best way to verify CSRF defenses is by executing browser-based PoCs to inspect token validation, cookie configurations, and header enforcement. This confirms whether state-changing actions reject unauthorized Cross-Site Request Forgery attempts.