What problem does it solve? Modern CSRF defenses (SameSite cookies, token validation, Content-Type enforcement) are frequently misconfigured, and manual testing often misses subtle bypasses like JSON-via-text/plain or sibling-subdomain attacks. This Skill provides a structured, evidence-gated methodology for finding and proving CSRF vulnerabilities during authorized bug bounty and security research engagements. ## Core Features & Use Cases - Autonomous Testing Flow: A prioritized sequence for mapping state-changing endpoints, testing token omission/substitution, and checking SameSite cookie attributes. - Bypass Technique Library: Documented bypasses for SameSite=Lax, Origin/Referer checks, double-submit cookies, and JSON Content-Type enforcement, grounded in 15 real disclosed reports (GitLab, Stripe, GitHub, TikTok, Argo CD). - PoC Templates & Detection Patterns: Ready-to-adapt HTML form payloads, curl commands for token replay, and grep patterns for reconnaissance. - Use Case: While testing a target's account settings page, use the methodology to discover that the email-change endpoint accepts a text/plain body without a CSRF token, then build a cross-origin PoC page demonstrating account takeover. ## Quick Start Use $hunt-csrf to plan an evidence-gated, authorized validation path for CSRF on my target's state-changing endpoints.
