An attacker changes the profile information of a particular user (victim) on the target website. The attacker uses this string to update the victim's profile to a text file and then submit the data…

Question

Options

• ABrowser Hacking
• BCross-Site Scripting
• CSQL Injection
• DCross-Site Request Forgery

• A
  6% (2)
• C
  3% (1)
• D
  91% (29)

Explanation

Cross-Site Request Forgery (CSRF) Explained

Option D is correct because CSRF is an attack where a malicious actor tricks a victim's browser into submitting unauthorized requests (via HTTP GET or POST) to a target website where the victim is authenticated - in this case, using a hidden <iframe> to silently update profile data and send it to the attacker's server without the victim's knowledge.

Why the distractors are wrong:

• A (Browser Hacking) is too vague and not a recognized, specific attack category in cybersecurity terminology
• B (Cross-Site Scripting/XSS) involves injecting malicious scripts into a webpage that execute in other users' browsers - it targets the victim's browser directly, not forging requests on their behalf
• C (SQL Injection) involves inserting malicious SQL code into database queries to manipulate backend data - it has nothing to do with hidden iframes or forged user requests

Memory Tip: Think of CSRF as a "confused deputy" attack - the victim's browser is tricked into acting as the attacker's deputy, unknowingly carrying out malicious requests. Remember: CSRF = forged requests using the victim's credentials, while XSS = injected scripts. The hidden <iframe> is a classic CSRF delivery mechanism.

No community discussion yet for this question.