CSRF hunting
Cookie-authenticated state change without a token the browser cannot set. SameSite=Lax is not the whole story. JSON plus text/plain is the modern shape.
Skill
No skill is linked for this class yet. Start with the playbook on this page.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
None linked for this class yet.
Disclosures
- Local-device action exposure through DNS rebinding - Cross-site request forgery combined with DNS rebinding
Gadgets
- CSRF without a real origin check - State-changing cookie-auth requests that accept a cross-site POST become account or billing actions. JSON plus a missing CORS preflight is the modern shape.
Playbooks
- CSRF Hunting - State-changing requests that run as the victim from a foreign origin. JSON and SameSite made this rarer, not dead.
Tools
- Burp Suite - The industry-standard intercepting proxy for manual web testing. Community edition is free; Pro adds the active scanner and automation.
Payloads
- CSRF - Minimal PoC shapes. Prefer a real state-changing URL from the target. JSON needs a content-type the browser will send without a preflight.
Bypasses
- CSRF token and Origin gaps - Cookie-auth state change without a token the browser cannot set. SameSite=Lax is not the whole story.
Questions
Does SameSite=Lax kill CSRF?
It blocks classic cross-site POST in current Chrome. Subdomains, top-level GET, and fetches with cookies still matter.
What actions are worth reporting?
Email change, OAuth link, disable MFA, payout account, API keys. A change of theme is not.
This page is the linked pack hunt_brief("csrf") returns on the MCP connector. Authorized testing only.