hunt-csrf
Installation
SKILL.md
When to Use
Use when the target has any state-changing endpoint that a logged-in user can trigger — POST/PUT/DELETE on account settings, email changes, social account linking, OAuth flows, API calls, or file operations. CSRF exploits the trust a site has in a user's browser by forging cross-origin requests. Every form submission, AJAX call, OAuth callback, and API mutation is a candidate. Highest-value targets: account takeover vectors (OAuth/SSO flows, social account linking), authentication infrastructure (login CSRF, session fixation), JSON APIs accepting cross-origin POST, and third-party integrations (Grafana, monitoring dashboards).
⚠️ CRITICAL: curl ≠ browser. Model the browser security model.
CSRF PoC MUST work in a real browser, not just curl. The browser enforces rules that curl ignores:
| Browser Rule | curl Behavior | Real CSRF Impact |
|---|---|---|
SameSite=Lax |
curl sends cookie anyway | Blocks cookie on cross-site POST — no CSRF |
SameSite=Strict |
curl sends cookie anyway | Blocks cookie on all cross-site requests — no CSRF |
| CORS preflight | curl skips OPTIONS | Browser blocks if Content-Type: application/json |
Sec-Fetch-Site: cross-site |
curl doesn't send | Server can reject cross-site requests via this header |