Strix•CSRF 测试
Strix CSRF 测试手册,覆盖 token 绕过、SameSite、CORS 误配与状态变更滥用;触发名:strix-csrf
Profile →npx skills add asdfgh1445/ctf-super-hub --skill strix-csrf --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# CSRF Cross-site request forgery abuses ambient authority (cookies, HTTP auth) across origins. Do not rely on CORS alone; enforce non-replayable tokens and strict origin checks for every state change. ## Attack Surface **Session Types** - Web apps with cookie-based sessions and HTTP auth - JSON/REST, GraphQL (GET/persisted queries), file upload endpoints **Authentication Flows** - Login/logout, password/email change, MFA toggles **OAuth/OIDC** - Authorize, token, logout, disconnect/connect endpoints ## High-Value Targets - Credentials and profile changes (email/password/phone) - Payment and money movement, subscription/plan changes - API key/secret generation, PAT rotation, SSH keys - 2FA/TOTP enable/disable; backup codes; device trust - OAuth connect/disconnect; logout; account deletion - Admin/staff actions and impersonation flows - File uploads/deletes; access control changes ## Reconnaissance ### Session and Cookies - Inspect cookies: HttpOnly, Secure, SameSite (Strict/Lax/None) - Lax allows cookies on top-level cross-site GET; None requires Secure - Determine if Authorization headers or bearer tokens are used (generally not CSRF-prone) versus cookies (CSRF-prone) ### Token an
- Attack Surface
- High-Value Targets
- Reconnaissance
- Session and Cookies
- Token and Header Checks
- Method and Content-Types
- CORS Profile
- Key Vulnerabilities
- Navigation CSRF
- Simple Content-Type CSRF
- JSON CSRF
- Login/Logout CSRF
- OAuth/OIDC Flows
- File and Action Endpoints
What does the Strix•CSRF 测试 skill do?
Strix CSRF 测试手册,覆盖 token 绕过、SameSite、CORS 误配与状态变更滥用;触发名:strix-csrf
How do I install it?
Run `npx skills add asdfgh1445/ctf-super-hub --skill strix-csrf --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From asdfgh1445/ctf-super-hub, a repository with 718 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.