domains / families / security / hunt-csrf

hunt-csrf

combined

Hunting skill for csrf vulnerabilities. Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO (YoYo Games $400), social-account-link CSRF (HackerOne), JSON-CSRF via text/plain on email-change (TikTok $500). Use when hunting modern CSRF — heavy emphasis on chain-to-ATO patterns.

When to use

You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.
✅ Endpoint changes state (POST/PUT/DELETE)
✅ Cookie has `SameSite=None` OR `SameSite=Lax` with GET-based action
✅ No custom CSRF token/header required
✅ PoC works from a **different origin in a real browser**
Many modern web frameworks (for example, those with CSRF protection enabled by default) reject state-changing requests such as POST, PUT, or DELETE with a `403 Forbidden` response when the CSRF token is missing or invalid.
In some applications, if the `PATCH` method is not covered by the same CSRF middleware or is handled differently, it may be possible to perform the same state-changing action using PATCH instead. This can result in a CSRF protection bypass…

When not to use

Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

Both copies describe the same CSRF hunting workflow (state-changing endpoints, SameSite/CORS constraints, token bypasses, high-value targets), but each contains material steps the other lacks. The uphiago copy emphasizes the browser security model, a SameSite cheat sheet, and a PATCH-method middleware bypass. The sickn33 copy adds a mandatory authorization gate, a raw-HTTP-client shortcut for naive Origin/Referer string checks, and a concrete four-step autonomous testing flow including text/plain JSON-CSRF. Crowning one would hide the other's unique constraints and techniques.