Detect and test CSRF vulnerabilities in web applications.
npx skills add https://github.com/securityfortech/hacking-skills --skill csrf-securityfortech
Please help me install this Agent Skill. Skill: csrf Source: https://github.com/securityfortech/hacking-skills/tree/main/skills/web/client-side/csrf Command: npx skills add https://github.com/securityfortech/hacking-skills --skill csrf-securityfortech
This Skill helps identify and mitigate Cross-Site Request Forgery (CSRF) vulnerabilities, protecting authenticated users from malicious forged requests.
Test the provided web application for Cross-Site Request Forgery vulnerabilities.
High-intent search queries and answers about installing and using this skill.
To test for CSRF vulnerabilities, analyze state-changing requests for missing or predictable CSRF tokens, inadequate SameSite cookie attributes, and insecure JSON endpoint configurations using automated vulnerability testing methods.
A CSRF token is a unique, unpredictable value required for state-changing requests that prevents Cross-Site Request Forgery attacks by verifying requests originate from the legitimate application rather than a malicious site.
Validate CSRF findings by generating proof-of-concept payloads using HTML auto-submitting forms, XHR requests, and CORS-enabled fetch to confirm insecure endpoints process forged cross-site requests successfully.
Yes, Burp Suite and OWASP ZAP work for generating CSRF proof-of-concept exploits by intercepting state-changing requests and crafting the necessary HTML forms or fetch requests to demonstrate the vulnerability.
Yes, you can use SameSite cookie attributes to prevent CSRF on insecure JSON endpoints by enforcing strict browser policies, though you must also validate that endpoints reject cross-origin XHR and CORS-enabled fetch requests.
harperaaImplement HMAC-SHA256 CSRF token protection for POST, PUT, and DELETE API routes.
0x0pointerValidate and exploit CVEs with Metasploit in a controlled container.
jcastillotxIntercept and analyze HTTP traffic with Burp Suite proxy tools.
naporin0624Analyzes HTML forms for CSRF tokens, insecure actions, missing validation, hidden field exposure and misconfigurations, generating text or JSON reports.
