hunt-csrf
基于大量实战报告，适合赏金猎人和渗透测试。
含攻击与漏洞利用内容，禁止未授权使用
识别与利用 CSRF 弱点，覆盖现代变体与高价值场景。
定位现代化的 CSRF 弱点和利用链：包括 SameSite 旁路、GraphQL mutation via GET、路径遍历绕过 CSRF token、Origin 省略导致的绕过、WebSocket/CSWSH 等变体。在追求账号接管（ATO）或敏感操作链路时非常有用，因为 CSRF 常能直接触发关键操作。特点是很多漏洞不是传统表单问题，而是浏览器行为、SameSite 配置或中间件失误导致的复杂绕过。
▸ 展开 SKILL.md 英文原文
Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO (YoYo Games $400), social-account-link CSRF (HackerOne), JSON-CSRF via text/plain on email-change (TikTok $500). Use when hunting modern CSRF — heavy emphasis on chain-to-ATO patterns.
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-csrf/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-csrf/SKILL.md"## Shortcut: a raw HTTP client beats a real cross-origin page for header-check CSRF A raw HTTP client (curl, Burp Repeater, any scripting client) is not a browser: it will send whatever `Origin`/`Referer` header VALUE you set, from any path, on the same connection as your authenticated cookie. Many apps that claim to defend against CSRF only do a naive **string check** on the incoming `Origin`/`Referer` header (does it contain/equal some expected value?) rather than real same-origin enforcement — you can satisfy that check directly by setting the header, with no actual cross-site delivery (hosting an HTML page, a headless browser) required. This is faster and more reliable than building a r