What problem does it solve? Cross-Site Request Forgery testing often produces false positives because curl-based checks ignore browser security rules like SameSite cookies and CORS preflights. This Skill guides systematic CSRF hunting that models real browser behavior, so findings are exploitable in practice and survive triage. ## Core Features & Use Cases - Browser-accurate verification: Enforces a SameSite/CORS checklist so PoCs work in a real browser, not just curl, eliminating false positives from SameSite=Lax POST blocking. - Modern bypass coverage: Documents SameSite=Lax sibling-subdomain bypasses, GraphQL mutations-via-GET, path-traversal token bypasses, JSON-CSRF via text/plain, WebSocket CSRF (CSWSH), and Duende BFF antiforgery weaknesses. - Chain-to-ATO focus: Prioritizes high-impact targets like OAuth/social account linking, email change, and SAML RelayState manipulation, backed by 15 disclosed bug bounty reports (GitLab, Stripe, GitHub, TikTok, Argo CD). - Use Case: While testing a target's account settings, you find a POST email-change endpoint. The Skill walks you through checking the session cookie's SameSite attribute, testing token omission and cross-session reuse, then building a hosted HTML PoC that proves account takeover in a real browser. ## Quick Start Ask the agent to hunt for CSRF vulnerabilities on the target's authenticated state-changing endpoints and build a browser-verified PoC for any exploitable finding.
