skills.rest
cybersecwoman
cybersecwomanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-csrf

Identify CSRF vulnerabilities by analyzing URL patterns, response headers, and JavaScript/DOM patterns.

5|Updated May 27, 2026
Search Tags:#vulnerability assessment#penetration testing#web security#application security#bug hunting#CSRF
One-click install
npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill hunt-csrf-cybersecwoman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-csrf
Source: https://github.com/cybersecwoman/Kiro-BugHunter/tree/main/skills/hunt-csrf
Command: npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill hunt-csrf-cybersecwoman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill unit helps identify and mitigate Cross-Site Request Forgery (CSRF) vulnerabilities in web applications, protecting against unauthorized actions performed by users without their consent.

Core Features & Use Cases

  • CSRF Detection: Identifies CSRF vulnerabilities by analyzing URL patterns, response headers, and JavaScript/DOM patterns.
  • Attack Surface Signals: Provides signals to identify vulnerable areas in web applications, including URL patterns, response headers, and tech stack signals.
  • Hunting Methodology: Offers a step-by-step methodology for hunting CSRF vulnerabilities, including mapping state-changing endpoints, checking cookie SameSite attributes, and testing token staticness.
  • Payload & Detection Patterns: Provides PoC payloads and detection patterns for various CSRF attack scenarios.
  • Bypass Techniques: Details bypass techniques for common CSRF defenses like SameSite cookies, CSRF tokens, and Content-Type enforcement.
  • Gate 0 Validation: Validates the real impact of CSRF vulnerabilities on user accounts and data.
  • Real Impact Examples: Illustrates real-world examples of CSRF vulnerabilities and their impact on user accounts and data.
  • Duende BFF Analysis: Analyzes CSRF vulnerabilities in the Duende BFF framework and its attack patterns.
  • Related Skills & Chains: Recommends related skills and chains for further security analysis.

Quick Start

Run the hunt-csrf skill to identify CSRF vulnerabilities in your web application.

Frequently Asked Questions about hunt-csrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify CSRF vulnerabilities in web applications?▼

Identify CSRF vulnerabilities by analyzing URL patterns, response headers, JavaScript/DOM patterns, and tech stack signals. This involves mapping state-changing endpoints, checking cookie SameSite attributes, and testing token staticness to detect unprotected areas.

What is the step-by-step methodology for hunting CSRF vulnerabilities?▼

The CSRF hunting methodology involves mapping state-changing endpoints, checking cookie SameSite attributes, testing token staticness, and analyzing response headers. It provides PoC payloads and detection patterns to test web application defenses systematically.

How can I bypass common CSRF defenses like SameSite cookies and token enforcement?▼

Bypass common CSRF defenses using detailed techniques for SameSite cookies, CSRF tokens, and Content-Type enforcement. The methodology provides specific bypass patterns and PoC payloads to test the robustness of existing web security configurations.

Does this CSRF detection approach work with specific frameworks like Duende BFF?▼

Yes, the CSRF detection methodology analyzes vulnerabilities specifically within the Duende BFF framework. It examines framework-specific attack patterns and tech stack signals to validate the real impact on user accounts and data.

How do I validate the real impact of a CSRF vulnerability on user accounts?▼

Validate the real impact of CSRF vulnerabilities using Gate 0 validation to assess unauthorized actions performed on user accounts. The analysis illustrates real-world examples of how these vulnerabilities affect user data and consent.

Related Skills

Explore More Software Engineering Skills→
cmndcntrlcybercmndcntrlcyber
3

hunt-misc

Identify and generate exploits for miscellaneous web application vulnerabilities.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

csrf

Exploits CSRF vulnerabilities in state-changing web endpoints and generates HTML PoC pages.

Official
Advanced
cybersecwomancybersecwoman
5

hunt-xss

Detect and analyze XSS vulnerabilities in web applications using Python.

Community
Advanced
Kisilev13Kisilev13

hunt-csrf

Scans web applications for CSRF vulnerabilities by inspecting CSRF tokens, SameSite cookie settings, and JSON endpoints.

Community
Advanced