@gpzhang2001/sharpkit-skills 0.2.1

package/skills/vulnerabilities/browser_security.md

@@ -0,0 +1,192 @@
+---
+name: browser-security
+description: Browser-internals security testing for browsing-context relationships, postMessage, client-side path traversal, XS-Leaks, service workers, Web Workers, navigation behavior, CSP interactions, caches, and cross-origin state machines
+---
+
+# Browser Security
+
+Use this skill when exploitability depends on browser behavior beyond a basic HTML injection. Model origins, browsing contexts, navigation history, workers, caches, router decoding, request metadata, and user activation as explicit state.
+
+Pair this skill with `xss`, `oauth`, `open_redirect`, `csrf`, or `semantic_confusion` when one of those is the primary vulnerability class. For an Electron renderer with a preload or IPC bridge, load `electron_desktop_apps` to analyze whether navigation and origin transitions reach native capability.
+
+## Safety Boundary
+
+- Use a controlled browser profile, synthetic account/data, explicit target allowlist, and a fresh assessment-specific proxy/CA when interception is required.
+- Redact tokens, cookies, message contents, storage values, and personal data from console logs, captures, recordings, and reports.
+- Treat oversized URLs/headers, cookie inflation, redirect loops, cache exhaustion, and high-rate timing trials as resource/denial-of-service tests; run them only with strict ceilings in a restartable lab.
+- Do not attempt to set or spoof browser-generated `event.origin`. Vary the sender URL and record the serialized origin supplied by the browser.
+- Restore monkey-patched browser APIs and unregister test workers/caches after validation.
+
+## Browser State Model
+
+For each relevant page or worker, record:
+
+- origin and site, including transitions after navigation
+- top-level window, opener, parent, child frames, named contexts, and retained references
+- sandbox flags, CSP `frame-ancestors`, COOP, COEP, CORP, and X-Frame-Options
+- service-worker controller and scope
+- storage access: cookies, local/session storage, IndexedDB, Cache API
+- navigation/history entries and redirect type: HTTP, JavaScript, form, meta refresh
+- user-activation and interaction requirements
+- browser family/version and enabled experimental features
+
+Draw the context graph. Security checks on `event.origin`, `event.source`, or a popup reference are meaningful only when the lifetime and ownership of that context are understood.
+
+## High-Value Surfaces
+
+### postMessage and Window Relationships
+
+- Enumerate listeners and senders; record message schema, origin check, source check, and reachable sinks/actions.
+- Validate origins after URL parsing and canonicalization, not with raw-string regexes.
+- Test numeric/alternate IP forms, userinfo, path masquerading as a host suffix, and redirects.
+- Treat predictable `window.open()` target names and iframe names as potentially shared namespace entries. Confirm reuse within the same browsing-context group, opener chain, COOP state, and relevant navigation/message timing.
+- Check whether a blocked intermediate frame leaves a useful browsing-context relationship intact.
+- Use random per-flow names or `_blank` with `noopener` where an opener relationship is unnecessary.
+
+### Client-Side Path Traversal
+
+Trace the complete source-to-request pipeline:
+
+```text
+browser URL -> router parser -> route/query/hash accessor -> app interpolation -> fetch/XHR -> final normalized URL
+```
+
+- Test path parameters, query parameters, and hashes independently.
+- Determine exactly where `%2F`, `%5C`, `%2E`, and double-encoded forms decode or re-encode.
+- Instrument `fetch`, XHR, Axios, router navigation, and server-side fetch wrappers to capture the final URL.
+- Escalate only after identifying the sink: state-changing API for CSRF-like impact, HTML/attachment response rendered in an unsafe sink for XSS, or server-side fetch for SSRF.
+- Do not assume the same framework API behaves identically in client components, server components, and route handlers.
+
+### XS-Leaks and Cross-Origin Oracles
+
+Inventory observable signals that do not require reading the cross-origin response:
+
+- load/error events for script, image, stylesheet, frame, media, and module elements
+- timing, connection reuse, cache state, redirect count, and navigation success
+- window/frame count, focus, history length, and resource dimensions
+- browser-generated error pages and status-dependent behavior
+- request headers such as `Sec-Fetch-Dest`, `Sec-Fetch-Mode`, and `Origin`
+
+Test controls such as ORB, CORP, COEP, and MIME enforcement. A service worker or alternate fetch path can change request destination metadata and therefore change whether a blocked response becomes a network error or an empty response. Validate the oracle across authenticated and unauthenticated control cases.
+
+### Service Workers and Caches
+
+- Map service-worker registration scope, update lifecycle, controller acquisition, and fetch handlers.
+- Inspect Cache API keys and responses; determine whether HTML or JavaScript is served directly from a writable cache.
+- Test whether a constrained script context can poison app-managed cache entries later consumed by a normal page or service worker.
+- Treat service-worker persistence as high impact, but prove registration/control scope and update survivability.
+- Compare a direct subresource request with the same request proxied through `fetch(event.request)`; request destination and mode can differ.
+
+### Web Workers and Constrained Script Execution
+
+When script runs inside a worker, inventory capabilities instead of dismissing it as low impact:
+
+- credentialed same-origin `fetch` for data access and state changes
+- `postMessage` gadgets into the main page
+- IndexedDB and Cache API shared with other same-origin contexts
+- Blob construction and object URLs
+- import mechanisms, WebSocket, and available browser-specific APIs
+
+Prove the strongest reliable capability first. If escalation requires a user gesture, document the exact gesture, timing, browser, and visibility rather than calling it zero-click XSS.
+
+### Navigation and Redirect Control
+
+- Distinguish HTTP 30x, script navigation, form submission, meta refresh, and popup navigation.
+- Test invalid or blocked URL schemes and WAF-generated error pages only when they support a real flow. Oversized URLs/headers, cookie-path-specific header inflation, redirect limits, and navigation throttling are restartable-lab-only tests with strict size/iteration limits and health checks.
+- A sandbox inherited by a new top-level context can selectively block forms, scripts, popups, or navigation; enumerate the exact flag set.
+- Preserve and inspect history when a built-in error page replaces the active document; do not assume the errored URL is lost.
+
+### CSP and Browser Parsing
+
+- Evaluate the delivered policy on the exact response, including redirects and error/API/static paths.
+- Map nonces, hashes, `strict-dynamic`, allowed schemes, trusted script gadgets, `base-uri`, `frame-ancestors`, and Trusted Types.
+- Test parser namespaces and repairs in HTML, SVG, and MathML. A protected attribute or sanitizer rule in the HTML namespace may behave differently after namespace transitions.
+- Treat scriptless disclosure of a nonce or trusted URL as a primitive; prove a second controllable sink before claiming bypass.
+- For response splitting, consider whether a same-origin endpoint can be turned into a script resource with a controlled body length or framing.
+
+### JavaScript Gadget Discovery
+
+- When direct calls are blocked, inspect implicit coercions (`toString`, `valueOf`, iterators, getters, proxies) and callbacks invoked by accessible library functions.
+- Search for functions whose `this` object and arguments can be attacker-shaped.
+- Build a bounded harness to enumerate reachable globals and observe property reads/calls; avoid assuming one library gadget is universal.
+- Validate the complete call chain to a dangerous sink such as navigation, HTML insertion, `eval`, `Function`, or a privileged API.
+
+## Reconnaissance
+
+### Runtime Instrumentation
+
+Instrument in a controlled browser session:
+
+```javascript
+const realFetch = window.fetch;
+window.fetch = (...args) => {
+  const input = args[0];
+  const rawUrl = typeof input === 'string' ? input : input.url;
+  const url = new URL(rawUrl, location.href);
+  const method = args[1]?.method || input?.method || 'GET';
+  console.log('fetch', {method, origin: url.origin, path: url.pathname});
+  return realFetch(...args);
+};
+
+window.addEventListener('message', e => {
+  const keys = e.data && typeof e.data === 'object' ? Object.keys(e.data) : [];
+  console.log('message', {origin: e.origin, sourceMatches: e.source === window.opener, keys});
+}, true);
+```
+
+Use the wrapper only in the controlled profile and restore `window.fetch = realFetch` afterward. Do not log bodies, message values, credentials, or query strings.
+
+Also inspect DevTools network initiators, service workers, storage, CSP violations, frame tree, and navigation history. Use raw browser behavior for validation; command-line HTTP clients cannot reproduce origin/window/worker semantics.
+
+### Source Review
+
+- Search for `postMessage`, message listeners, `window.open`, named targets, opener/parent access, frame creation, and sandbox attributes.
+- Search for router parameter APIs flowing into `fetch`, Axios, navigation, or HTML rendering.
+- Search for service-worker registration, Cache API writes, worker constructors, Blob URLs, and dynamic imports.
+- Search for raw HTML sinks and trust escape hatches in every supported frontend framework.
+- Compare CSP and framing headers across document, API, static, callback, redirect, and error routes.
+
+## Testing Methodology
+
+1. **Define the browser state** - Origin/site, context graph, policies, workers, storage, and activation.
+2. **Identify a source and observable sink** - Message, URL component, cache entry, navigation, load/error event, or implicit call.
+3. **Trace transformations** - URL parsing, framework decode, browser normalization, request destination, and document replacement.
+4. **Build paired controls** - Same-origin/cross-origin, status success/error, worker/direct, unique/predictable window name, encoded/raw path.
+5. **Prove the primitive** - Data transfer, path change, state oracle, cache modification, or context capture.
+6. **Escalate deliberately** - Chain to a privileged action, sensitive disclosure, SSRF, or executable DOM sink.
+7. **Cross-browser check** - At minimum record Chromium/Firefox/Safari applicability when the primitive is browser-specific.
+8. **State interaction requirements** - Click, drag, popup permission, timing window, login state, and visual deception.
+
+## Validation
+
+1. Capture the context graph and relevant policies at exploit time.
+2. Show the exact browser-parsed origin or final request URL, not just the attacker-supplied string.
+3. For postMessage, prove both message origin and source/context ownership.
+4. For XS-Leaks, repeat randomized success/failure trials and quantify separation and noise.
+5. For workers/caches, show which later context consumes the modified data.
+6. For client-side traversal, capture the final network request and the security-relevant response/action.
+7. For interaction-dependent chains, provide a screen recording or deterministic event trace.
+
+## False Positives
+
+- A message reaches a listener but fails schema, origin, source, or state validation before any action
+- A router decodes traversal characters but the value never reaches a URL/path sink
+- Different load/error behavior caused by unstable network rather than protected state
+- Worker script execution with no sensitive API, shared state, main-thread gadget, or meaningful action
+- CSP nonce disclosure without a controllable way to reuse it in an executable sink
+- Named-window collision blocked by origin scoping, randomized names, COOP, or `noopener`
+- Browser-specific behavior reported without the required version, flag, or user interaction
+
+## Pro Tips
+
+1. Treat browsing-context names as attacker-contestable identifiers unless randomized.
+2. Query parameters are usually decoded automatically; path parameters vary by router and execution context.
+3. Compare request metadata, not just URLs. Service workers can alter destination/mode semantics.
+4. A strict origin check does not compensate for attacker control of the supposedly trusted window reference.
+5. Error pages, redirects, and blocked frames still mutate history and context relationships.
+6. Keep browser-version claims narrow and retest; these behaviors change faster than server-side primitives.
+7. Prefer a small state-machine explanation over a large payload catalog.
+
+## Summary
+
+Browser exploitation is state-machine exploitation. Map origins, context references, policies, workers, storage, navigation, and decoding as one system. Prove each state transition with browser evidence, then chain only the primitives that survive the target's browser and interaction constraints.

package/skills/vulnerabilities/business_logic.md

@@ -0,0 +1,178 @@
+---
+name: business-logic
+description: Business logic testing for workflow bypass, state manipulation, and domain invariant violations
+---
+
+# Business Logic Flaws
+
+Business logic flaws exploit intended functionality to violate domain invariants: move money without paying, exceed limits, retain privileges, or bypass reviews. They require a model of the business, not just payloads.
+
+## Attack Surface
+
+- Financial logic: pricing, discounts, payments, refunds, credits, chargebacks
+- Account lifecycle: signup, upgrade/downgrade, trial, suspension, deletion
+- Authorization-by-logic: feature gates, role transitions, approval workflows
+- Quotas/limits: rate/usage limits, inventory, entitlements, seat licensing
+- Multi-tenant isolation: cross-organization data or action bleed
+- Event-driven flows: jobs, webhooks, sagas, compensations, idempotency
+
+## High-Value Targets
+
+- Pricing/cart: price locks, quote to order, tax/shipping computation
+- Discount engines: stacking, mutual exclusivity, scope (cart vs item), once-per-user enforcement
+- Payments: auth/capture/void/refund sequences, partials, split tenders, chargebacks, idempotency keys
+- Credits/gift cards/vouchers: issuance, redemption, reversal, expiry, transferability
+- Subscriptions: proration, upgrade/downgrade, trial extension, seat counts, meter reporting
+- Refunds/returns/RMAs: multi-item partials, restocking fees, return window edges
+- Admin/staff operations: impersonation, manual adjustments, credit/refund issuance, account flags
+- Quotas/limits: daily/monthly usage, inventory reservations, feature usage counters
+
+## Reconnaissance
+
+### Workflow Mapping
+
+- Derive endpoints from the UI and proxy/network logs; map hidden/undocumented API calls, especially finalize/confirm endpoints
+- Identify tokens/flags: stepToken, paymentIntentId, orderStatus, reviewState, approvalId; test reuse across users/sessions
+- Document invariants: conservation of value (ledger balance), uniqueness (idempotency), monotonicity (non-decreasing counters), exclusivity (one active subscription)
+
+### Input Surface
+
+- Hidden fields and client-computed totals; server must recompute on trusted sources
+- Alternate encodings and shapes: arrays instead of scalars, objects with unexpected keys, null/empty/0/negative, scientific notation
+- Business selectors: currency, locale, timezone, tax region; vary to trigger rounding and ruleset changes
+
+### State and Time Axes
+
+- Replays: resubmit stale finalize/confirm requests
+- Out-of-order: call finalize before verify; refund before capture; cancel after ship
+- Time windows: end-of-day/month cutovers, daylight saving, grace periods, trial expiry edges
+
+## Key Vulnerabilities
+
+### State Machine Abuse
+
+- Skip or reorder steps via direct API calls; verify server enforces preconditions on each transition
+- Replay prior steps with altered parameters (e.g., swap price after approval but before capture)
+- Split a single constrained action into many sub-actions under the threshold (limit slicing)
+
+### Concurrency and Idempotency
+
+- Parallelize identical operations to bypass atomic checks (create, apply, redeem, transfer)
+- Abuse idempotency: key scoped to path but not principal → reuse other users' keys; or idempotency stored only in cache
+- Message reprocessing: queue workers re-run tasks on retry without idempotent guards; cause duplicate fulfillment/refund
+
+### Numeric and Currency
+
+- Floating point vs decimal rounding; rounding/truncation favoring attacker at boundaries
+- Cross-currency arbitrage: buy in currency A, refund in B at stale rates; tax rounding per-item vs per-order
+- Negative amounts, zero-price, free shipping thresholds, minimum/maximum guardrails
+
+### Quotas, Limits, and Inventory
+
+- Off-by-one and time-bound resets (UTC vs local); pre-warm at T-1s and post-fire at T+1s
+- Reservation/hold leaks: reserve multiple, complete one, release not enforced; backorder logic inconsistencies
+- Distributed counters without strong consistency enabling double-consumption
+
+### Refunds and Chargebacks
+
+- Double-refund: refund via UI and support tool; refund partials summing above captured amount
+- Refund after benefits consumed (downloaded digital goods, shipped items) due to missing post-consumption checks
+
+### Feature Gates and Roles
+
+- Feature flags enforced client-side or at edge but not in core services; toggle names guessed or fallback to default-enabled
+- Role transitions leaving stale capabilities (retain premium after downgrade; retain admin endpoints after demotion)
+
+## Advanced Techniques
+
+### Event-Driven Sagas
+
+- Saga/compensation gaps: trigger compensation without original success; or execute success twice without compensation
+- Outbox/Inbox patterns missing idempotency → duplicate downstream side effects
+- Cron/backfill jobs operating outside request-time authorization; mutate state broadly
+
+### Microservices Boundaries
+
+- Cross-service assumption mismatch: one service validates total, another trusts line items; alter between calls
+- Header trust: internal services trusting X-Role or X-User-Id from untrusted edges
+- Partial failure windows: two-phase actions where phase 1 commits without phase 2, leaving exploitable intermediate state
+
+### Multi-Tenant Isolation
+
+- Tenant-scoped counters and credits updated without tenant key in the where-clause; leak across orgs
+- Admin aggregate views allowing actions that impact other tenants due to missing per-tenant enforcement
+
+## Bypass Techniques
+
+- Content-type switching (JSON/form/multipart) to hit different code paths
+- Method alternation (GET performing state change; overrides via X-HTTP-Method-Override)
+- Client recomputation: totals, taxes, discounts computed on client and accepted by server
+- Cache/gateway differentials: stale decisions from CDN/APIM that are not identity-aware
+
+## Special Contexts
+
+### E-commerce
+
+- Stack incompatible discounts via parallel apply; remove qualifying item after discount applied; retain free shipping after cart changes
+- Modify shipping tier post-quote; abuse returns to keep product and refund
+
+### Banking/Fintech
+
+- Split transfers to bypass per-transaction threshold; schedule vs instant path inconsistencies
+- Exploit grace periods on holds/authorizations to withdraw again before settlement
+
+### SaaS/B2B
+
+- Seat licensing: race seat assignment to exceed purchased seats; stale license checks in background tasks
+- Usage metering: report late or duplicate usage to avoid billing or to over-consume
+
+## Chaining Attacks
+
+- Business logic + race: duplicate benefits before state updates
+- Business logic + IDOR: operate on others' resources once a workflow leak reveals IDs
+- Business logic + CSRF: force a victim to complete a sensitive step sequence
+
+## Testing Methodology
+
+1. **Enumerate state machine** - Per critical workflow (states, transitions, pre/post-conditions); note invariants
+2. **Build Actor × Action × Resource matrix** - Unauth, basic user, premium, staff/admin; identify actions per role
+3. **Test transitions** - Step skipping, repetition, reordering, late mutation
+4. **Introduce variance** - Time, concurrency, channel (mobile/web/API/GraphQL), content-types
+5. **Validate persistence boundaries** - All services, queues, and jobs re-enforce invariants
+
+## Validation
+
+1. Show an invariant violation (e.g., two refunds for one charge, negative inventory, exceeding quotas)
+2. Provide side-by-side evidence for intended vs abused flows with the same principal
+3. Demonstrate durability: the undesired state persists and is observable in authoritative sources (ledger, emails, admin views)
+4. Quantify impact per action and at scale (unit loss × feasible repetitions)
+
+## False Positives
+
+- Promotional behavior explicitly allowed by policy (documented free trials, goodwill credits)
+- Visual-only inconsistencies with no durable or exploitable state change
+- Admin-only operations with proper audit and approvals
+
+## Impact
+
+- Direct financial loss (fraud, arbitrage, over-refunds, unpaid consumption)
+- Regulatory/contractual violations (billing accuracy, consumer protection)
+- Denial of inventory/services to legitimate users through resource exhaustion
+- Privilege retention or unauthorized access to premium features
+
+## Pro Tips
+
+1. Start from invariants and ledgers, not UI—prove conservation of value breaks
+2. Test with time and concurrency; many bugs only appear under pressure
+3. Recompute totals server-side; never accept client math—flag when you observe otherwise
+4. Treat idempotency and retries as first-class: verify key scope and persistence
+5. Probe background workers and webhooks separately; they often skip auth and rule checks
+6. Validate role/feature gates at the service that mutates state, not only at the edge
+7. Explore end-of-period edges (month-end, trial end, DST) for rounding and window issues
+8. Use minimal, auditable PoCs that demonstrate durable state change and exact loss
+9. Chain with authorization tests (IDOR/Function-level access) to magnify impact
+10. When in doubt, map the state machine; gaps appear where transitions lack server-side guards
+
+## Summary
+
+Business logic security is the enforcement of domain invariants under adversarial sequencing, timing, and inputs. If any step trusts the client or prior steps, expect abuse.

package/skills/vulnerabilities/csrf.md

@@ -0,0 +1,198 @@
+---
+name: csrf
+description: CSRF testing covering token bypass, SameSite cookies, CORS misconfigurations, and state-changing request abuse
+---
+
+# CSRF
+
+Cross-site request forgery abuses ambient authority (cookies, HTTP auth) across origins. Do not rely on CORS alone; enforce non-replayable tokens and strict origin checks for every state change.
+
+## Attack Surface
+
+**Session Types**
+- Web apps with cookie-based sessions and HTTP auth
+- JSON/REST, GraphQL (GET/persisted queries), file upload endpoints
+
+**Authentication Flows**
+- Login/logout, password/email change, MFA toggles
+
+**OAuth/OIDC**
+- Authorize, token, logout, disconnect/connect endpoints
+
+## High-Value Targets
+
+- Credentials and profile changes (email/password/phone)
+- Payment and money movement, subscription/plan changes
+- API key/secret generation, PAT rotation, SSH keys
+- 2FA/TOTP enable/disable; backup codes; device trust
+- OAuth connect/disconnect; logout; account deletion
+- Admin/staff actions and impersonation flows
+- File uploads/deletes; access control changes
+
+## Reconnaissance
+
+### Session and Cookies
+
+- Inspect cookies: HttpOnly, Secure, SameSite (Strict/Lax/None)
+- Lax allows cookies on top-level cross-site GET; None requires Secure
+- Determine if Authorization headers or bearer tokens are used (generally not CSRF-prone) versus cookies (CSRF-prone)
+
+### Token and Header Checks
+
+- Locate anti-CSRF tokens (hidden inputs, meta tags, custom headers)
+- Test removal, reuse across requests, reuse across sessions, binding to method/path
+- Verify server checks Origin and/or Referer on state changes
+- Test null/missing and cross-origin values
+
+### Method and Content-Types
+
+- Confirm whether GET, HEAD, or OPTIONS perform state changes
+- Try simple content-types to avoid preflight: `application/x-www-form-urlencoded`, `multipart/form-data`, `text/plain`
+- Probe parsers that auto-coerce `text/plain` or form-encoded bodies into JSON
+
+### CORS Profile
+
+- Identify `Access-Control-Allow-Origin` and `-Credentials`
+- Overly permissive CORS is not a CSRF fix and can turn CSRF into data exfiltration
+- Test per-endpoint CORS differences; preflight vs simple request behavior can diverge
+
+## Key Vulnerabilities
+
+### Navigation CSRF
+
+- Auto-submitting form to target origin; works when cookies are sent and no token/origin checks are enforced
+- Top-level GET navigation can trigger state if server misuses GET or links actions to GET callbacks
+
+### Simple Content-Type CSRF
+
+- `application/x-www-form-urlencoded` and `multipart/form-data` POSTs do not require preflight
+- `text/plain` form bodies can slip through validators and be parsed server-side
+
+### JSON CSRF
+
+- If server parses JSON from `text/plain` or form-encoded bodies, craft parameters to reconstruct JSON
+- Some frameworks accept JSON keys via form fields (e.g., `data[foo]=bar`) or treat duplicate keys leniently
+
+### Login/Logout CSRF
+
+- Force logout to clear CSRF tokens, then chain login CSRF to bind victim to attacker's account
+- Login CSRF: submit attacker credentials to victim's browser; later actions occur under attacker's account
+
+### OAuth/OIDC Flows
+
+- Abuse authorize/logout endpoints reachable via GET or form POST without origin checks
+- Exploit relaxed SameSite on top-level navigations
+- Open redirects or loose redirect_uri validation can chain with CSRF to force unintended authorizations
+
+### File and Action Endpoints
+
+- File upload/delete often lack token checks; forge multipart requests to modify storage
+- Admin actions exposed as simple POST links are frequently CSRFable
+
+### GraphQL CSRF
+
+- If queries/mutations are allowed via GET or persisted queries, exploit top-level navigation with encoded payloads
+- Batched operations may hide mutations within a nominally safe request
+
+### WebSocket CSRF
+
+- Browsers send cookies on WebSocket handshake
+- Enforce Origin checks server-side; without them, cross-site pages can open authenticated sockets and issue actions
+
+## Bypass Techniques
+
+### SameSite Nuance
+
+- Lax-by-default cookies are sent on top-level cross-site GET but not POST
+- Exploit GET state changes and GET-based confirmation steps
+- Legacy or nonstandard clients may ignore SameSite; validate across browsers/devices
+
+### Origin/Referer Obfuscation
+
+- Sandbox/iframes can produce null Origin; some frameworks incorrectly accept null
+- `about:blank`/`data:` URLs alter Referer
+- Ensure server requires explicit Origin/Referer match
+
+### Method Override
+
+- Backends honoring `_method` or `X-HTTP-Method-Override` may allow destructive actions through a simple POST
+
+### Token Weaknesses
+
+- Accepting missing/empty tokens
+- Tokens not tied to session, user, or path
+- Tokens reused indefinitely; tokens in GET
+- Double-submit cookie without Secure/HttpOnly, or with predictable token sources
+
+### Content-Type Switching
+
+- Switch between form, multipart, and `text/plain` to reach different code paths
+- Use duplicate keys and array shapes to confuse parsers
+
+### Header Manipulation
+
+- Strip Referer via meta refresh or navigate from `about:blank`
+- Test null Origin acceptance
+- Leverage misconfigured CORS to add custom headers that servers mistakenly treat as CSRF tokens
+
+## Special Contexts
+
+### Mobile/SPA
+
+- Deep links and embedded WebViews may auto-send cookies; trigger actions via crafted intents/links
+- SPAs that rely solely on bearer tokens are less CSRF-prone, but hybrid apps mixing cookies and APIs can still be vulnerable
+
+### Integrations
+
+- Webhooks and back-office tools sometimes expose state-changing GETs intended for staff
+- Confirm CSRF defenses there too
+
+## Chaining Attacks
+
+- CSRF + IDOR: force actions on other users' resources once references are known
+- CSRF + Clickjacking: guide user interactions to bypass UI confirmations
+- CSRF + OAuth mix-up: bind victim sessions to unintended clients
+
+## Testing Methodology
+
+1. **Inventory endpoints** - All state-changing endpoints including admin/staff
+2. **Note request details** - Method, content-type, whether reachable via simple requests
+3. **Assess session model** - Cookies with SameSite attrs, custom headers, tokens
+4. **Check defenses** - Anti-CSRF tokens and Origin/Referer enforcement
+5. **Attempt preflightless delivery** - Form POST, text/plain, multipart/form-data
+6. **Test navigation** - Top-level GET navigation
+7. **Cross-browser validation** - Behavior differs by SameSite and navigation context
+
+## Validation
+
+1. Demonstrate a cross-origin page that triggers a state change without user interaction beyond visiting
+2. Show that removing the anti-CSRF control (token/header) is accepted, or that Origin/Referer are not verified
+3. Prove behavior across at least two browsers or contexts (top-level nav vs XHR/fetch)
+4. Provide before/after state evidence for the same account
+5. If defenses exist, show the exact condition under which they are bypassed (content-type, method override, null Origin)
+
+## False Positives
+
+- Token verification present and required; Origin/Referer enforced consistently
+- No cookies sent on cross-site requests (SameSite=Strict, no HTTP auth) and no state change via simple requests
+- Only idempotent, non-sensitive operations affected
+
+## Impact
+
+- Account state changes (email/password/MFA), session hijacking via login CSRF
+- Financial operations, administrative actions
+- Durable authorization changes (role/permission flips, key rotations) and data loss
+
+## Pro Tips
+
+1. Prefer preflightless vectors (form-encoded, multipart, text/plain) and top-level GET if available
+2. Test login/logout, OAuth connect/disconnect, and account linking first
+3. Validate Origin/Referer behavior explicitly; do not assume frameworks enforce them
+4. Toggle SameSite and observe differences across navigation vs XHR
+5. For GraphQL, attempt GET queries or persisted queries that carry mutations
+6. Always try method overrides and parser differentials
+7. Combine with clickjacking when visual confirmations block CSRF
+
+## Summary
+
+CSRF is eliminated only when state changes require a secret the attacker cannot supply and the server verifies the caller's origin. Tokens and Origin checks must hold across methods, content-types, and transports.