Identify the attack from the following sequence of actions? Step 1: A user logs in to a trusted site and creates a new session Step 2: The trusted site stores a session identifier for the session in a cookie in the web browser Step 3: The user is tricked to visit a malicious site Step 4: the malicious site sends a request from the user's browser using his session cookie

Identify the attack from the following sequence of actions? Step 1: A user logs in to a trusted site and creates a new session Step 2: The trusted site stores a session identifier for the session in a cookie in the web browser Step 3: The user is tricked to visit a malicious site Step 4: the malicious site sends a request from the user's browser using his session cookie

• A. Web Application Denial-of-Service (DoS) Attack
• B. Cross-Site Scripting (XSS) Attacks
• C. Cross-Site Request Forgery (CSRF) Attack
• D. Hidden Field Manipulation Attack

Answer: (C)

The main idea here is a forgery of a request using an authenticated session. After the user logs in to a trusted site, the site assigns a session cookie that the browser automatically sends with each request to that site. If the user later visits a malicious site, that site can cause the browser to issue a request to the trusted site, and because the browser includes the session cookie, the trusted site treats the request as if the real user authorized it. In essence, actions are performed in the context of the victim’s authenticated session without the user initiating them directly on the trusted site. This is cross-site request forgery. That’s why the other options don’t fit. A DoS attack aims to exhaust resources and doesn’t rely on abusing the user’s authenticated session in this way. XSS requires injecting and executing malicious script within the victim’s browser on a trusted site, whereas CSRF relies on forged requests that the browser sends automatically with the user’s cookies. Hidden field manipulation involves altering form data submitted by the user, not leveraging the browser’s automatic cookie-based authentication to forge a request to another site.

The main idea here is a forgery of a request using an authenticated session. After the user logs in to a trusted site, the site assigns a session cookie that the browser automatically sends with each request to that site. If the user later visits a malicious site, that site can cause the browser to issue a request to the trusted site, and because the browser includes the session cookie, the trusted site treats the request as if the real user authorized it. In essence, actions are performed in the context of the victim’s authenticated session without the user initiating them directly on the trusted site. This is cross-site request forgery.

That’s why the other options don’t fit. A DoS attack aims to exhaust resources and doesn’t rely on abusing the user’s authenticated session in this way. XSS requires injecting and executing malicious script within the victim’s browser on a trusted site, whereas CSRF relies on forged requests that the browser sends automatically with the user’s cookies. Hidden field manipulation involves altering form data submitted by the user, not leveraging the browser’s automatic cookie-based authentication to forge a request to another site.