Csrf Cross Site Request Forgery

Loads expert CSRF attack patterns with a focus on modern bypass techniques that base models typically miss. Covers the full range from basic token validation flaws (token not validated server-side being the most common) to SameSite cookie edge cases, JSON CSRF via content-type tricks, and OAuth state parameter attacks. Especially strong on the double-submit cookie pattern vulnerabilities and the two-minute Lax cookie exemption in Chrome. Includes ready-to-use HTML proof-of-concept templates for different attack vectors. Best deployed when auditing state-changing endpoints like password resets, email changes, or admin role assignments where you need to systematically check token implementation and cookie behavior rather than just surface-level CSRF presence.

skills.sh installs: 3.9K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill csrf-cross-site-request-forgery --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: CSRF — Cross-Site Request Forgery — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert CSRF techniques. Covers modern bypass vectors (SameSite gaps, custom header flaws, tokenless bypass patterns), JSON CSRF, multipart CSRF, chaining with XSS. Base models often present only basic CSRF without covering SameSite edge cases and common broken token implementations.

0. RELATED ROUTING

Also load:

cors cross origin misconfiguration when JSON endpoints become readable cross-origin
oauth oidc misconfiguration when login, account linking, or callback binding relies on OAuth state