Cross-Site Request Forgery

Which is not an alternative name for cross-site request forgery?

• CSRF

• Sea Surf

• DDoS

• Session Riding

A CSRF attack exploits the trust...

• a server has in its clients

• clients have in the server

CSRF is mostly used to...

• obtain data dumps

• brute-force credentials

• perform state-changing operations

• gain control of the victim's machine

In CSRF, the malicious request is typically sent from...

• the victim's browser

• the attacker's web server

• the attacker's browser

• the server itself

Which is not an example of confused deputy problem?

• clickjacking

• FTP bounce attack

• SQLi

• CSRF

All but one can help prevent CSRF from a client's perspective.

• log out of websites

• use secure passwords

• clear cookies

• avoid clicking on suspicious links

In a CSRF attack, the server typically sends the response to...

• the attacker

• a spoofed e-mail address

• the victim

• a proxy server

I understand what I need to do for the assignment due on Monday 24 April

• Yes, it's all clear

• I hope so, I will know better once I start

• Sort of, I have a few questions

• No, please help

What can be used to prevent CSRF from a server's perspective?

• unpredictable tokens

• encryption

• block Javascript

• parameterised queries

According to the OWASP, stored CSRF is more severe.

• True

• False