What is the primary goal of a Cross-Site Request Forgery (CSRF) attack?

Question

Options

• AExecute JavaScript in a victim's browser
• BSteal session cookies
• CForce a victim to perform an unwanted action
• DGain shell access to the server

• A
  3% (2)
• B
  7% (5)
• C
  76% (53)
• D
  14% (10)

Explanation

C is correct because CSRF exploits the trust a web application has in an authenticated user's browser - it tricks the victim's browser into sending a forged request (e.g., a fund transfer or password change) to a site where the victim is already logged in, without the victim's knowledge or consent.

Why the distractors are wrong:

• A (Execute JavaScript) - That's Cross-Site Scripting (XSS), a different attack that injects malicious scripts into a page.
• B (Steal session cookies) - CSRF doesn't steal cookies; it abuses the existing authenticated session. Cookie theft is more associated with XSS or network sniffing.
• D (Shell access) - Gaining a shell is the goal of remote code execution (RCE) attacks, not CSRF, which operates entirely within the browser/HTTP layer.

Memory tip: Think of CSRF as a "puppet attack" - the attacker pulls the victim's strings, making their authenticated browser perform actions the victim never intended. The key word is force, and the defense is an unpredictable token (CSRF token) that a forged request can't know.

No community discussion yet for this question.