skills.rest
Acczdy
AcczdyCOMMUNITY
Explore all skills by this author →
GitHub

performing-csrf-attack-simulation

Analyze CSRF protections and generate PoC payloads for authorized testing.

2|Updated Apr 14, 2026
Search Tags:#web-security#csrf#penetration-testing#csrf-poc#token-detection#same-site
One-click install
npx skills add https://github.com/Acczdy/MoZiSec --skill performing-csrf-attack-simulation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-csrf-attack-simulation
Source: https://github.com/Acczdy/MoZiSec/tree/main/web-security/.claude/skills/performing-csrf-attack-simulation
Command: npx skills add https://github.com/Acczdy/MoZiSec --skill performing-csrf-attack-simulation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

CSRF Attack Simulation helps security testers identify weaknesses in anti-CSRF protections by analyzing web app endpoints, detecting missing or weak defenses, and producing practical proof-of-concept payloads for authorized testing.

Core Features & Use Cases

  • Analyze CSRF protections on target URLs and detect token patterns and SameSite cookie configurations
  • Generate reusable CSRF PoC HTML payloads and produce a structured report for authorized testing
  • Scan forms for state-changing endpoints and summarize protections and potential vulnerabilities

Quick Start

Run the CSRF Attack Simulation Agent against an authorized target URL to generate a vulnerability report and PoC HTML.

Frequently Asked Questions about performing-csrf-attack-simulation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a CSRF PoC payload for testing a web application endpoint?▼

To generate a CSRF PoC payload, this Skill analyzes target web app endpoints for missing tokens or weak SameSite cookies and produces reusable HTML payloads for authorized testing. It scans forms to identify state-changing actions lacking proper validation.

Can I use Python requests to scan for SameSite cookie weaknesses and CSRF vulnerabilities?▼

Yes, you can use Python requests to scan for SameSite cookie weaknesses. The Skill uses the library for HTTP interactions to inspect cookie attributes, discover state-changing endpoints, and report vulnerabilities with generated proof-of-concept payloads.

What is the best way to test web apps for missing anti-CSRF protections on state-changing endpoints?▼

The best way to test for missing anti-CSRF protections is to scan forms for state-changing endpoints and evaluate token implementation. The Skill summarizes protections, identifies weaknesses in header validation or SameSite policies, and outputs a structured vulnerability report.

Do I need authorized access to run a CSRF attack simulation against a target URL?▼

Yes, you need authorized access to run a CSRF attack simulation against a target URL. The Skill produces actionable PoC payloads and structured reports specifically for authorized testing of web applications to identify anti-CSRF defense weaknesses.

Related Skills

Explore More Software Engineering Skills→
xianmingyaoxianmingyao
1

http-api-cloudbase

Access CloudBase features via HTTP API without SDKs.

Community
Intermediate
YukiIto1999YukiIto1999

performing-csrf-attack-simulation

Detect CSRF protections and generate PoC payloads for web applications.

Community
Advanced
windshockwindshock
3

sec-audit-dast

Automate DAST/ASM security assessments and aggregate findings into SARIF outputs.

Community
Advanced
uphiagouphiago
1.1k

hunt-csrf

Detect modern CSRF vulnerabilities including SameSite bypasses and OAuth RelayState flaws.

Community
Advanced