How does a cross-site request forgery attack operate?

Question

Options

• Asubmitting unauthorized commands from a user trusted by an application
• Binjecting malicious script code into the data stored on a server
• Cinjecting malicious code into a browser that uses a valid HTTP request
• Dusing JavaScript to write data into the value within a cookie

• A
  88% (49)
• B
  7% (4)
• C
  4% (2)
• D
  2% (1)

Explanation

A Cross-Site Request Forgery (CSRF) attack works by tricking a user, who is authenticated and trusted by an application, into performing unintended actions (e.g., submitting a form or making a request) without their consent. Since the application trusts the user's credentials (e.g., session cookies), it processes the malicious request as legitimate. 1. An attacker creates a malicious link or form and tricks the victim into clicking it. 2. The victim's browser sends the request along with the authenticated session cookie to the trusted application. 3. The application executes the unauthorized command, assuming it originated from the legitimate user.

No community discussion yet for this question.