vulns.co
/
mcp by GKData.io

CSRF hunting

Cookie-authenticated state change without a token the browser cannot set. SameSite=Lax is not the whole story. JSON plus text/plain is the modern shape.

Playbooks

  • CSRF Hunting - State-changing requests that run as the victim from a foreign origin. JSON and SameSite made this rarer, not dead.

Gadgets

  • Framable authenticated page - Usually P5. Becomes real when a sensitive state-changing UI is framable (disable 2FA, OAuth approve, delete, wire).
  • WebSocket IDOR / missing auth - Subscribe to another user's channel, replay a privileged event, or skip the HTTP auth that the REST API has.
  • CSRF without a real origin check - State-changing cookie-auth requests that accept a cross-site POST become account or billing actions. JSON plus a missing CORS preflight is the modern shape.

Payloads

  • CSRF - Minimal PoC shapes. Prefer a real state-changing URL from the target. JSON needs a content-type the browser will send without a preflight.
  • CSS injection / data exfil - When HTML is escaped but CSS is not. Attribute selectors can leak CSRF tokens and one-time codes a character at a time.
  • OAuth / OIDC - redirect_uri tricks, implicit flow, mixed response_type, state CSRF. Pair with the OAuth playbook.
  • Clickjacking / UI redress - Frame an authenticated sensitive page. Proof is a framed screenshot of a state-changing UI you own, plus missing X-Frame-Options / CSP frame-ancestors.

Bypasses

  • CSRF token and Origin gaps - Cookie-auth state change without a token the browser cannot set. SameSite=Lax is not the whole story.

Tools

  • graphql-cop - Fast security auditor for GraphQL: checks introspection, batching, field suggestions, CSRF, and DoS-prone features in one pass.

Related disclosures

Questions

Does SameSite=Lax kill CSRF?

It blocks classic cross-site POST in current Chrome. Subdomains, top-level GET, and fetches with cookies still matter.

What actions are worth reporting?

Email change, OAuth link, disable MFA, payout account, API keys. A change of theme is not.

This page is the public form of hunt_brief("csrf") on the MCP connector. Authorized testing only.