https://cybertoolchain.io/tools/xsrfprobe New releases and features in xsrfprobe, tracked by The Cyber Toolchain. en Sun, 12 Jul 2026 07:07:02 GMT https://github.com/0xInfection/XSRFProbe/releases/tag/v3.0.0 https://github.com/0xInfection/XSRFProbe/releases/tag/v3.0.0 Sun, 12 Jul 2026 07:07:02 GMT XSRFProbe v3 rebuilds the CSRF engine with 25 categorized checks, headless-browser SameSite bypasses, and JSON reporting. • Adds a full battery of 25 named checks (D1–A1) covering token tampering, method/Content-Type overrides, Origin/Referer bypasses, SameSite cookie analysis, and token strength — each with a unique ID, severity rating, and exploitability notes. • New token-tampering checks (T2–T8) actively probe GET↔POST method switching, token omission, empty values, cross-session replay, double-submit cookies, and custom-header token forgery. • New Origin/Referer bypass checks (R0–R2c, O1–O3) test header removal, regex tricks, subdomain tricks, and `Origin: null` against real-world validation implementations. • New SameSite bypass checks (S2–S4) probe `SameSite=Strict` via client-side redirect gadgets and sibling-subdomain XSS, and `SameSite=Lax` via cookie-refresh/OAuth flows. • Adds optional headless Firefox (Selenium) integration via `--browser` for browser-dependent SameSite bypass tests and auto-validation of generated PoCs. • New bounded crawler with configurable `--max-urls`, `--max-depth`, and `--crawl-timeout` flags to control scan scope. • Adds `--json` flag for machine-readable JSON reports; each finding includes `test_id`, `severity`, and an `exploitability` note. • Supports optional subdomain enumeration via crt.sh for sibling-domain SameSite bypass testing. • Generates tailored, auto-validated exploitable CSRF proof-of-concept pages per finding. • Adds response diffing/benchmark engine to reduce false positives before declaring an endpoint vulnerable. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xsrfprobe https://github.com/0xInfection/XSRFProbe/releases/tag/v3.0.0 https://github.com/0xInfection/XSRFProbe/releases/tag/v3.0.0 Sun, 12 Jul 2026 07:07:02 GMT XSRFProbe v3 rebuilds the CSRF engine with 25 categorized checks, headless-browser SameSite bypasses, and JSON reporting. • Adds a full battery of 25 named checks (D1–A1) covering token tampering, method/Content-Type overrides, Origin/Referer bypasses, SameSite cookie analysis, and token strength — each with a unique ID, severity rating, and exploitability notes. • New token-tampering checks (T2–T8) actively probe GET↔POST method switching, token omission, empty values, cross-session replay, double-submit cookies, and custom-header token forgery. • New Origin/Referer bypass checks (R0–R2c, O1–O3) test header removal, regex tricks, subdomain tricks, and `Origin: null` against real-world validation implementations. • New SameSite bypass checks (S2–S4) probe `SameSite=Strict` via client-side redirect gadgets and sibling-subdomain XSS, and `SameSite=Lax` via cookie-refresh/OAuth flows. • Adds optional headless Firefox (Selenium) integration via `--browser` for browser-dependent SameSite bypass tests and auto-validation of generated PoCs. • New bounded crawler with configurable `--max-urls`, `--max-depth`, and `--crawl-timeout` flags to control scan scope. • Adds `--json` flag for machine-readable JSON reports; each finding includes `test_id`, `severity`, and an `exploitability` note. • Supports optional subdomain enumeration via crt.sh for sibling-domain SameSite bypass testing. • Generates tailored, auto-validated exploitable CSRF proof-of-concept pages per finding. • Adds response diffing/benchmark engine to reduce false positives before declaring an endpoint vulnerable. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xsrfprobe https://github.com/0xInfection/XSRFProbe/releases/tag/v3.0.0 https://github.com/0xInfection/XSRFProbe/releases/tag/v3.0.0 Sun, 12 Jul 2026 07:07:02 GMT XSRFProbe v3 rebuilds the CSRF engine with 25 categorized checks, headless-browser SameSite bypasses, and JSON reporting. • Adds a full battery of 25 named checks (D1–A1) covering token tampering, method/Content-Type overrides, Origin/Referer bypasses, SameSite cookie analysis, and token strength — each with a unique ID, severity rating, and exploitability notes. • New token-tampering checks (T2–T8) actively probe GET↔POST method switching, token omission, empty values, cross-session replay, double-submit cookies, and custom-header token forgery. • New Origin/Referer bypass checks (R0–R2c, O1–O3) test header removal, regex tricks, subdomain tricks, and `Origin: null` against real-world validation implementations. • New SameSite bypass checks (S2–S4) probe `SameSite=Strict` via client-side redirect gadgets and sibling-subdomain XSS, and `SameSite=Lax` via cookie-refresh/OAuth flows. • Adds optional headless Firefox (Selenium) integration via `--browser` for browser-dependent SameSite bypass tests and auto-validation of generated PoCs. • New bounded crawler with configurable `--max-urls`, `--max-depth`, and `--crawl-timeout` flags to control scan scope. • Adds `--json` flag for machine-readable JSON reports; each finding includes `test_id`, `severity`, and an `exploitability` note. • Supports optional subdomain enumeration via crt.sh for sibling-domain SameSite bypass testing. • Generates tailored, auto-validated exploitable CSRF proof-of-concept pages per finding. • Adds response diffing/benchmark engine to reduce false positives before declaring an endpoint vulnerable. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xsrfprobe