Analyze state-changing endpoints and authentication flows for CSRF vulnerabilities.
npx skills add https://github.com/pdparchitect/rook --skill hunt-csrf-pdparchitect
Please help me install this Agent Skill. Skill: hunt-csrf Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-csrf Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-csrf-pdparchitect
This skill addresses the difficulty of identifying complex, modern Cross-Site Request Forgery (CSRF) vulnerabilities that bypass traditional defenses like SameSite cookies or basic token validation.
Use the hunt-csrf skill to analyze the target application for state-changing endpoints and test them for CSRF token omission or reuse vulnerabilities.
High-intent search queries and answers about installing and using this skill.
To find CSRF vulnerabilities bypassing SameSite cookies, you need to analyze state-changing endpoints for sibling-subdomain bypasses and verify if token validation is properly bound to user identity. This skill systematically maps authenticated actions to detect these modern CSRF bypasses.
A JSON-CSRF vulnerability occurs when an attacker forces a victim's browser to send a cross-site POST request using text/plain content-type abuse to bypass standard CSRF protection mechanisms. This skill identifies these sophisticated patterns by analyzing JSON-based APIs for missing or improperly validated tokens.
Testing OAuth callback endpoints for CSRF-related account takeover involves analyzing OAuth/SSO relay state manipulation and social account linking flows. This skill audits these integrations to determine if an attacker can force a victim to link an unauthorized social account without a valid CSRF token.
Yes, you can audit GraphQL mutations for CSRF vulnerabilities via GET requests. This skill detects modern CSRF patterns including GraphQL mutations-via-GET by systematically mapping authenticated actions and verifying token omission or reuse vulnerabilities.
To systematically map and validate state-changing endpoints for CSRF token omissions, you analyze authentication flows and verify token binding to user identity. This skill targets authenticated actions to identify where attackers can perform state-changing operations without valid tokens.
ricardoo022Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.
uphiagoDetect modern CSRF vulnerabilities including SameSite bypasses and OAuth RelayState flaws.
alexfazioIntercept and inspect Claude Code API traffic using mitmproxy.
ano4lIdentify vulnerabilities in web applications, APIs, and infrastructure through authorized offensive security testing.
