csrf-cors-origin

name	csrf-cors-origin
description	CSRF token-bypass techniques, CORS misconfiguration patterns, postMessage origin issues, clickjacking, and WebSocket cross-origin hijacking. Converted from master-pentest-prompt.md Phase 10. Use on any state-changing request, any endpoint with CORS headers, and any page that could be framed.

CSRF / CORS / origin

When to use

Any state-changing request (form submit, API call with side effects), any response carrying Access-Control-Allow-Origin, and any page worth framing for clickjacking.

CSRF

Token bypass techniques: duplicate token submission, null token, a session-tied check that can be satisfied without the real token, regex prefix matching that a crafted value slips past. Also: integer/boolean maze parameters, JSON content-type tricks (legacy old-browser CSRF via form-encoded JSON), multipart/form-data bypass, GET-to-POST method switching, Referer regex bypass.

CORS

Null origin, arbitrary origin reflected with credentials: true, subdomain-origin trust, regex bypass (e.g. a check that matches evil.com when it meant to match not-evil.com), preflight request smuggling.

Hard rule before claiming anything: Access-Control-Allow-Origin: * cannot legally be combined with credentials -- if the server sends ACAO: *, the browser refuses to expose the response body to a credentials: include request, full stop. That's Informational/Low, not a finding, regardless of what curl shows (curl doesn't enforce CORS -- it happily displays a reflected header a real browser would block). A High needs: attacker origin reflected in ACAO + ACAC: true + a browser-proven readable body via mcp__browser-mcp (fetch with credentials:"include" from the test page, confirm the body actually renders, not just that the header looks promising).

Subdomain-regex bypass -- match the payload to the actual flaw, don't throw one generic bypass at every target:

Intended regex	Flaw	Bypass that matches
^https?://.*\.target\.com$	none (escaped dot + end-anchor)	no simple bypass -- look at subdomain-takeover instead
^https?://.*target\.com$	missing dot separator	https://eviltarget.com
^https?://.*\.target\.com	missing end-anchor $	https://x.target.com.evil.com
^https?://target\.com	prefix-only, no $	https://target.com.evil.com
.*.target.com$ (unescaped dot)	. matches any char	any origin one char off from target.com

evil.target.com reflecting back is not automatically a bug -- it's an in-scope subdomain by design unless you actually control it (see subdomain-takeover).

postMessage

Null origin checks, unvalidated message event handling, window.name abuse, popup-opener relationship abuse (see the reconnaissance skill's JS-mining checklist item 3 for finding the actual addEventListener handlers first).

Clickjacking

Test everywhere, including sandboxed-iframe bypass techniques (a sandbox attribute doesn't always prevent the framed page from still being interactable in an exploitable way).

WebSocket CORS

Cross-origin WebSocket hijack, missing Origin header validation on the WS upgrade request.