312-49 · Question #120
Identify the attack from following sequence of actions? Step 1: A user logs in to a trusted site and creates a new session Step 2: The trusted site stores a session identifier for the session in a…
The correct answer is C. Cross-Site Request Forgery (CSRF) Attack. The described sequence is a Cross-Site Request Forgery (CSRF) attack. The victim is authenticated to a trusted site (Step 1), which sets a session cookie (Step 2). A malicious site then tricks the victim's browser into sending an authenticated request to the trusted site using…
Question
Identify the attack from following sequence of actions? Step 1: A user logs in to a trusted site and creates a new session Step 2: The trusted site stores a session identifier for the session in a cookie in the web browser Step 3: The user is tricked to visit a malicious site Step 4: the malicious site sends a request from the user's browser using his session cookie
Options
- AWeb Application Denial-of-Service (DoS) Attack
- BCross-Site Scripting (XSS) Attacks
- CCross-Site Request Forgery (CSRF) Attack
- DHidden Field Manipulation Attack
How the community answered
(44 responses)- A2% (1)
- B2% (1)
- C91% (40)
- D5% (2)
Explanation
The described sequence is a Cross-Site Request Forgery (CSRF) attack. The victim is authenticated to a trusted site (Step 1), which sets a session cookie (Step 2). A malicious site then tricks the victim's browser into sending an authenticated request to the trusted site using that cookie (Steps 3-4), causing the trusted site to execute an action as if the legitimate user requested it. This differs from XSS (which injects scripts into the trusted site) and DoS (which overwhelms a service). The attacker exploits the browser's automatic inclusion of cookies in cross-origin requests.
Topics
Community Discussion
No community discussion yet for this question.