hunt-csrf

## Crown Jewel Targets CSRF becomes high-value when it touches **state-changing actions with account-level or financial consequences**. The highest-paying targets are: - **Account takeover vectors**: OAuth/SSO flows (RelayState manipulation), social account linking/unlinking (Oculus-Facebook, SocialClub), import-friends features that expose OAuth tokens - **Authentication infrastructure**: Login CSRF, session fixation via CSRF, forced account association - **API endpoints accepting cross-origin POST**: JSON APIs, heartbeat/activity APIs, anything that skips Content-Type enforcement - **Third-party integrations**: Grafana, monitoring dashboards, embedded analytics — often lag on CSRF protections - **Social platforms**: Twitter/X collections, friend imports, social graph mutations — high-volume, authenticated actions with real user impact **Asset types that pay most:** Core product auth flows > API gateways > third-party integrations running on subdomains > admin panels. --- ## Attack Surface Signals ### URL Patterns ``` /oauth/authorize?RelayState= /accounts/link /import/friends /api/v*/heartbeat /api/v*/collect /monitoring/* (Grafana, Prow, Prometheus) /auth/saml/callback /connect/* (social integrations) ``` ### Response Header Signals ``` # Missing or weak SameSite cookie attributes Set-Cookie: session=abc123; HttpOnly # no SameSite = vulnerable Set-Cookie: session=abc123; SameSite=None # explicitly allows cross-site # Missing CSRF headers # No X-Frame-Optio...