hunt-csrf

1## Shortcut: a raw HTTP client beats a real cross-origin page for header-check CSRF
2 
3A raw HTTP client (curl, Burp Repeater, any scripting client) is not a browser: it will send
4whatever `Origin`/`Referer` header VALUE you set, from any path, on the same connection as your
5authenticated cookie. Many apps that claim to defend against CSRF only do a naive **string check**
6on the incoming `Origin`/`Referer` header (does it contain/equal some expected value?) rather than
7real same-origin enforcement — you can satisfy that check directly by setting the header, with no
8actual cross-site delivery (hosting an HTML page, a headless browser) required. This is faster and
9more reliable than building a real attacker page for this exact pattern:
10```
11POST /profile HTTP/1.1
12Content-Type: application/x-www-form-urlencoded
13Origin: https://a-domain-the-app-treats-as-trusted-or-attacker-controlled.example
14Cookie: <authenticated session>
15 
16username=csrf_poc
17```
18If some text names a SPECIFIC origin/domain as the "expected" attacker page, that literal value is
19often exactly what the server's check is looking for — try it verbatim in `Origin` (fall back to
20`Referer` if `Origin` alone doesn't flip it). Only build a real cross-origin page (actual browser
21delivery) when the target does genuine SameSite/fetch-based origin enforcement that a spoofed header
22can't satisfy.
23 
24## Autonomous Testing Priority
25…