Request Forgery Attacks

What is a cross-site request forgery (XSRF or CSRF)?

Answer explanation

An attack that impersonates the end user by performing some sort of actions on a website when in reality they did not execute these actions

What is the first line of defense against a CSRF attack?

Answer explanation

authentication process involving a username and password which prevent the hacker from logging into the user account

How can a malicious user bypass user authentication with API commands?

Answer explanation

The malicious user leverages the one time that the victim will be logged onto both the secure and unsecure sites and then injects commands that execute when the user enters authentication details

What are some ways to prevent a CSRF attack?

Answer explanation

Strong authentication - User access management

What is a client-side request forgery?

Answer explanation

Any attack that affects the user by compromising user data

hat are some examples of this type of forgery?

Answer explanation

Attempts to change user password - Transferring funds from a user account - Sending private messages from a web application

What is a server-side request forgery?

Answer explanation

Requests are forged with the intention of accessing application servers

How is a server-side request malicious payload delivered?

Answer explanation

Using URLs carrying data that can read and edit content from a website

What are some examples of a server-side request forgery?

Answer explanation

- Theft of authentication keys - Data and file extraction from servers - Executing database alteration commands