What is a common characteristic of both a watering hole attack and a drive-by attack?

Both attack types use the victim's web browser or browser-associated components (plugins, JavaScript engines, document renderers) as the primary exploitation surface. In both cases the victim is compromised simply by visiting a web page, with no additional user interaction required, making browser targeting the defining shared mechanism.

Watering hole attacks do target specific industries or groups, but drive-by attacks are broadly opportunistic and are not aimed at any particular vertical or organization.

Both attack types commonly rely on publicly available exploit kits and off-the-shelf vulnerabilities rather than requiring the attacker to develop custom exploits.

Neither attack type is based on server-side request forgery - both rely on client-side browser exploitation triggered when the victim loads a malicious page.