skills.rest
marcboggs
marcboggsCOMMUNITY
Explore all skills by this author →
GitHub

hunt-csrf

Detects and validates CSRF vulnerabilities in web applications using bug bounty methodology.

1|Updated Aug 21, 2026
Search Tags:#penetration testing#web security#csrf#bug bounty#vulnerability hunting#account takeover#samesite bypass
One-click install
npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill hunt-csrf-marcboggs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-csrf
Source: https://github.com/marcboggs/BMAD-AppSec-Orchestrator/tree/main/.claude/skills/hunt-csrf
Command: npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill hunt-csrf-marcboggs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web application security testers need a systematic way to find Cross-Site Request Forgery vulnerabilities, including modern variants that bypass SameSite cookies, Content-Type enforcement, and CSRF token validation, without missing high-impact account-takeover chains. ## Core Features & Use Cases - Attack Surface Mapping: Identifies state-changing endpoints, weak SameSite cookie attributes, static CSRF tokens, and JSON endpoints missing Content-Type enforcement through URL patterns, response headers, and JavaScript signals. - Step-by-Step Hunting Methodology: Provides a 10-step workflow covering token omission and substitution tests, OAuth RelayState validation, social account linking flows, and third-party dashboard checks (Grafana, Kibana). - Bypass Techniques & PoC Templates: Includes ready-to-adapt HTML form payloads, text/plain JSON-CSRF constructions, curl commands for token reuse testing, and bypasses for SameSite=Lax, Origin checks, and double-submit cookies. - Use Case: While testing a target's account settings page, use this Skill to discover that the email-change endpoint accepts text/plain requests without a CSRF token, then build a cross-origin PoC page demonstrating account takeover. ## Quick Start Use the hunt-csrf skill to test the authenticated settings endpoints on my authorized bug bounty target for CSRF vulnerabilities and build a proof of concept for any findings.

Frequently Asked Questions about hunt-csrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a web application for CSRF vulnerabilities?▼

Map all state-changing POST/PUT/DELETE endpoints, then test CSRF token omission and substitution, check SameSite cookie attributes, and verify whether JSON endpoints accept text/plain or form-encoded bodies. Build a cross-origin HTML PoC page to confirm the action executes with the victim's cookies.

How to bypass SameSite=Lax cookie protection in CSRF attacks?▼

SameSite=Lax still allows top-level navigation GET requests, so test whether sensitive actions can be triggered via GET or through POST-to-GET redirect chains. Sibling subdomains sharing a parent domain can also make SameSite irrelevant, as shown in the Argo CD CVE-2024-22424 case.

Can JSON API endpoints be vulnerable to CSRF?▼

Yes, if the server does not strictly enforce Content-Type: application/json. An HTML form with enctype="text/plain" and crafted input names can produce a valid JSON body that browsers send cross-origin without a CORS preflight, as demonstrated in the Stripe Dashboard report.

Does CSRF on a logout endpoint qualify as a valid bug bounty finding?▼

Generally no. Logout CSRF and actions without meaningful state-change consequences are canonical N/A reports. A valid finding requires concrete victim impact such as account takeover, financial loss, or data exposure, verified through a reproducible proof of concept.

What makes OAuth account linking vulnerable to CSRF?▼

OAuth and SAML flows rely on the state or RelayState parameter as a CSRF token. If it is missing, predictable, or not bound to the user, an attacker can send the victim a crafted callback URL that links the attacker's social account to the victim's profile, enabling account takeover.

Related Skills

Explore More Software Engineering Skills→
securityfortechsecurityfortech
6

web-fingerprinting

Identify web server type, frameworks, and versions via banner and header analysis.

Official
Intermediate
mlvpatelmlvpatel
1

verdict-gate

Validate bug bounty submissions against a 7-question gate and four pre-submission checks.

Community
Advanced
jellaharshithjellaharshith
1

hunt-oauth

Guide enumeration and testing of OAuth authorization, callback, token, and mobile deep link surfaces.

Community
Advanced
jayjpatel9717jayjpatel9717

csrf-testing

Scan web applications for CSRF vulnerabilities and test token validation.

Community
Advanced