hunt-csrf

## Shortcut: a raw HTTP client beats a real cross-origin page for header-check CSRF A raw HTTP client (curl, Burp Repeater, any scripting client) is not a browser: it will send whatever `Origin`/`Referer` header VALUE you set, from any path, on the same connection as your authenticated cookie. Many apps that claim to defend against CSRF only do a naive **string check** on the incoming `Origin`/`Referer` header (does it contain/equal some expected value?) rather than real same-origin enforcement — you can satisfy that check directly by setting the header, with no actual cross-site delivery (hosting an HTML page, a headless browser) required. This is faster and more reliable than building a real attacker page for this exact pattern: ``` POST /profile HTTP/1.1 Content-Type: application/x-www-form-urlencoded Origin: https://a-domain-the-app-treats-as-trusted-or-attacker-controlled.example Cookie: <authenticated session> username=csrf_poc ``` If some text names a SPECIFIC origin/domain as the "expected" attacker page, that literal value is often exactly what the server's check is looking for — try it verbatim in `Origin` (fall back to `Referer` if `Origin` alone doesn't flip it). Only build a real cross-origin page (actual browser delivery) when the target does genuine SameSite/fetch-based origin enforcement that a spoofed header can't satisfy. ## Autonomous Testing Priority **CSRF only matters on state-changing actions that a browser could be tricked into making cross-site.**...