mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.3 KiB
2.3 KiB
API Reference: Performing CSRF Attack Simulation
HTTP Headers for CSRF Protection
| Header | Description |
|---|---|
Set-Cookie: SameSite=Strict |
Prevents cookie from being sent in cross-site requests |
Set-Cookie: SameSite=Lax |
Allows cookies on top-level GET navigations only |
X-CSRF-Token |
Custom header carrying CSRF token |
Origin |
Sent by browsers on cross-origin POST requests |
Referer |
Indicates the source page of the request |
CSRF Token Patterns (HTML)
| Pattern | Framework |
|---|---|
<input name="csrf_token" value="..."> |
Generic |
<input name="csrfmiddlewaretoken"> |
Django |
<input name="authenticity_token"> |
Ruby on Rails |
<input name="__RequestVerificationToken"> |
ASP.NET |
<meta name="csrf-token" content="..."> |
Rails/Laravel meta tag |
requests Library
| Method | Description |
|---|---|
session.get(url) |
Fetch page to extract CSRF tokens |
session.post(url, data) |
Submit form with/without CSRF token |
session.cookies |
Access session cookies for SameSite analysis |
Key Libraries
- requests (
pip install requests): HTTP client with session cookie management - beautifulsoup4 (
pip install beautifulsoup4): Parse HTML forms and extract tokens - selenium (optional): Browser-based CSRF testing with full JS execution
PoC Generation
| Element | Purpose |
|---|---|
<form action="target" method="POST"> |
Cross-origin form submission |
<input type="hidden"> |
Pre-filled form parameters |
document.getElementById().submit() |
Auto-submit on page load |
<img src="target?action=delete"> |
GET-based CSRF via image tag |
OWASP Testing Guide
| Test ID | Description |
|---|---|
| WSTG-SESS-05 | Testing for Cross-Site Request Forgery |