Hunt Csrf
Hunting skill for csrf vulnerabilities.
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-csrf -g -a claude-code -y- Repository
- elementalsouls/Claude-BugHunter5.4k
- Category
- Security
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants, SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO (YoYo Games $400), social-account-link CSRF (HackerOne), JSON-CSRF via text/plain on email-change (TikTok $500). Use when hunting modern CSRF, heavy emphasis on chain-to-ATO patterns.
Shortcut: a raw HTTP client beats a real cross-origin page for header-check CSRF
A raw HTTP client (curl, Burp Repeater, any scripting client) is not a browser: it will send
whatever Origin/Referer header VALUE you set, from any path, on the same connection as your
authenticated cookie. Many apps that claim to defend against CSRF only do a naive string check
on the incoming Origin/Referer header (does it contain/equal some expected value?) rather than
real same-origin enforcement, you can satisfy that check directly by setting the header, with no
actual cross-site delivery (hosting an HTML page, a headless browser) required. This is faster and
more reliable than building a real attacker page for this exact pattern:
POST /profile HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Origin: https://a-domain-the-app-treats-as-trusted-or-attacker-controlled.example
Cookie: <authenticated session>
username=csrf_poc
If some text names a SPECIFIC origin/domain as the "expected" attacker page, that literal value is
often exactly what the server's check is looking for, try it verbatim in Origin (fall back to
Referer if Origin alone doesn't flip it). Only build a real cross-origin page (actual browser
delivery) when the target does genuine SameSite/fetch-based origin enforcement that a spoofed header
can't satisfy.
Autonomous Testing Priority
CSRF only matters on state-changing actions that a browser could be tricked into making cross-site.
