skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

csrf

Validate CSRF token enforcement and SameSite attributes on state-changing endpoints.

Updated Jul 30, 2026
Search Tags:#security#authentication#vulnerability#web-security#csrf#pentest
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill csrf-salmanabdurrahman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: csrf
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/csrf
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill csrf-salmanabdurrahman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the critical security risk of Cross-Site Request Forgery by providing a structured, authorized framework to test whether state-changing endpoints are properly protected against unauthorized cross-origin requests.

Core Features & Use Cases

  • Posture Assessment: Evaluates token enforcement, SameSite cookie attributes, and Referer/Origin header validation.
  • Bypass Testing: Systematically tests for token removal, cross-account reuse, and method-override vulnerabilities.
  • Use Case: A security engineer uses this skill to verify that a new user-settings update endpoint correctly validates CSRF tokens and rejects requests originating from unauthorized domains.

Quick Start

Use the csrf skill to initiate a baseline posture assessment for the state-changing endpoints defined in the current authorized scope.

Frequently Asked Questions about csrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test CSRF protection on state-changing web application endpoints?▼

Test CSRF protection by evaluating token enforcement, SameSite cookie attributes, and Referer/Origin header validation on state-changing endpoints to identify token bypasses and session integrity vulnerabilities.

What is a CSRF token bypass and how does cross-account reuse work?▼

A CSRF token bypass occurs when state-changing endpoints fail to properly validate tokens. Cross-account reuse exploits this by systematically testing token removal and cross-account token reuse to verify session integrity.

How do I perform a baseline posture assessment for CSRF vulnerabilities?▼

Initiate a baseline posture assessment for CSRF vulnerabilities by evaluating token enforcement, SameSite cookie attributes, and Origin header validation on authorized state-changing endpoints to verify session integrity.

Can I use this CSRF validation skill for authorized penetration testing workflows?▼

Yes, this CSRF validation skill applies to authorized security assessments requiring rigorous testing of authentication and session integrity, satisfying requirements for evidence-based security reporting and policy-compliant penetration testing.

Does SameSite cookie misconfiguration leave state-changing endpoints vulnerable to CSRF?▼

SameSite cookie misconfiguration leaves state-changing endpoints vulnerable to CSRF. Validate SameSite attributes alongside token enforcement and Origin header validation to ensure proper cross-origin request rejection.

What are the limitations of CSRF posture assessments on web application endpoints?▼

CSRF posture assessments are limited to authorized security testing scopes focusing strictly on state-changing endpoints, requiring rigorous authentication testing to generate evidence-based security reports.

Related Skills

Explore More Software Engineering Skills→
langbyyilangbyyi
96

race-condition

Identify race condition and TOCTOU vulnerabilities in web application state-changing operations.

Community
Advanced
utsavthakurutsavthakur

csrf-cross-site-request-forgery

Identify and analyze CSRF vulnerabilities in web applications.

Community
Advanced
hung-phanhung-phan

csrf

Implement CSRF prevention with SameSite cookies, tokens, and origin validation.

Community
Advanced
langbyyilangbyyi
96

csrf-cross-site-request-forgery

Identify and exploit CSRF vulnerabilities in web applications, including SameSite bypasses.

Community
Advanced