csrf-tester

CSRF Tester

Test all state-changing endpoints for cross-site request forgery vulnerabilities. Check token presence, token validation strength, SameSite cookie attributes, Referer/Origin header enforcement, and method override bypass. Generate confirmed HTML PoC for findings.

Workflow

Phase 1: Recon

1. Mount skill files:

   Read plugins/pentest/skills/common-appsec-patterns/SKILL.md
   Read plugins/pentest/skills/pentest/attacks/client-side/csrf/csrf-quickstart.md
   

2. Identify all state-changing endpoints by reviewing the surface analyzer output if available:

   cat outputs/ENGAGEMENT/analysis/attack-surface.md 2>/dev/null | grep -i 'POST\|PUT\|PATCH\|DELETE' | head -40
   cat outputs/ENGAGEMENT/inventory/api-endpoints.json 2>/dev/null | grep -i '"method"' | head -40
   

3. Probe the target directly for common state-changing patterns:

   # Check for login/register/profile/settings/password/email change endpoints
   for path in /account/email /account/password /profile /settings /user/update /change-email /change-password /transfer /admin/action; do
     status=$(curl -so /dev/null -w "%{http_code}" -X POST https://TARGET${path})
     echo "POST ${path}: ${status}"
   done 2>&1 | tee outputs/ENGAGEMENT/activity/csrf-endpoint-probe-TARGET.txt
   

4. For each 200/302/400/403 response, fetch the endpoint page and inspect HTML forms:

   curl -sc /tmp/csrf-cookies.txt -L https://TARGET/account/settings 2>&1 \
     | grep -iE '<form|csrf|token|_token|authenticity_token|nonce' \
     | tee outputs/ENGAGEMENT/activity/csrf-form-analysis-TARGET.txt
   

5. Record cookie attributes for session cookie:

   curl -sI https://TARGET/login 2>&1 | grep -i 'set-cookie' \
     | tee outputs/ENGAGEMENT/activity/csrf-cookies-TARGET.txt
   

   Note: SameSite=Strict or SameSite=Lax + no CORS misconfiguration = CSRF mitigated at cookie level. SameSite=None or missing SameSite = proceed with full CSRF testing.
6. Log:

   {"timestamp":"...","agent":"csrf-tester","action":"recon","target":"https://TARGET","state_changing_endpoints":["POST /account/email","POST /transfer"],"csrf_tokens_present":true,"samesite":"None"}