hunt-csrf

Map all state-changing POST/PUT/DELETE endpoints, then replay each request without its CSRF token using curl or Burp Repeater. If the action succeeds with a 2xx response and no token error, CSRF is confirmed. Also test token reuse across sessions and check SameSite cookie attributes.

Send the request with a text/plain or application/x-www-form-urlencoded Content-Type instead of application/json, since these are CORS simple requests that skip preflight. Craft form input names so the submitted body parses as valid JSON, which many servers accept.

No. Top-level navigation GET requests still carry Lax cookies, so GET-triggered state changes remain exploitable. Additionally, any sibling subdomain under the same parent domain can send requests that satisfy Lax, as shown in the Argo CD CVE-2024-22424 bypass.

Omit the token field entirely, submit an empty value, or reuse a token from another session, since some frameworks only validate format or presence. Also test whether tokens are static per session or shared across users, which makes them leakable.

Skip CSRF on login forms, logout endpoints, and read-only GET requests, since these lack a victim session to abuse or concrete impact. Programs expect demonstrable victim loss such as account takeover, financial change, or data modification.

Yes. WebSocket handshakes cannot carry custom antiforgery headers, enabling cross-site WebSocket hijacking when hubs exclude CSRF checks. Mobile apps with exported deeplink handlers may also perform state-changing actions via a link using the ambient session.