hunt-csrf

To find CSRF weaknesses enabling account takeover, systematically test authenticated web applications for missing SameSite cookie attributes, static or omitted CSRF tokens, and insufficient Origin/Referer validation on state-changing endpoints. Prioritize high-value flows like account linking and OAuth callback handling.

A CSRF token validation weakness in OAuth and SAML flows occurs when RelayState or callback handlers accept cross-origin state-changing requests without verifying dynamic tokens, allowing attackers to hijack authenticated sessions. This often happens when tokens are static, omitted, or substitutable across requests.

Test SameSite cookie attributes for CSRF risks by mapping authenticated endpoints and checking if cookies lack SameSite restrictions, allowing cross-origin POST requests to succeed. Validate by reproducing state-changing requests from a different origin under the victim’s session.

SameSite cookie protection may not stop CSRF on JSON endpoints if those endpoints accept cross-origin simple requests without additional token checks. Endpoints relying solely on cookies without SameSite enforcement or dynamic CSRF tokens remain vulnerable to state-changing attacks.

The best way to prioritize CSRF testing targets is focusing on high-value flows like account linking/unlinking, authentication infrastructure, OAuth/SAML callback handling, and cross-origin JSON APIs. These state-changing endpoints often yield account takeover if CSRF validation is insufficient.

CSRF token validation fails to prevent account takeover when tokens are static across sessions, omitted entirely, or substitutable with attacker-controlled values. Exploitable weaknesses in social account linking or OAuth flows let attackers force state changes under a victim’s authenticated session.