Cross-site request forgery (CSRF) in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the Nature of CSRF Attacks

What best describes a Cross-site request forgery (CSRF) attack?

A An attacker floods a website with traffic to cause a denial of service.

B An attacker intercepts and reads data sent between a user and a website.

C An attacker injects malicious code into a website to steal user data.

D An attacker tricks a user into submitting a request to a trusted website without their consent.

💡 Hint

Think about how the attacker uses the user's browser to perform actions.

CSRF tricks a user’s browser into sending unwanted requests to a trusted site where the user is authenticated, without their knowledge.

📋 Factual

intermediate

Common Defense Mechanisms Against CSRF

Which of the following is a common and effective defense against CSRF attacks?

A Using CAPTCHAs on all form submissions.

B Implementing CSRF tokens that are unique per user session.

C Encrypting all website traffic with HTTPS.

D Blocking all cookies from being sent by the browser.

💡 Hint

Look for a method that verifies the legitimacy of requests from the user.

CSRF tokens are unique values included in forms or requests that the server checks to confirm the request is genuine.

🔍 Analysis

advanced

Analyzing a CSRF Attack Scenario

A user is logged into their bank website. Meanwhile, they visit a malicious site that contains a hidden form that submits a money transfer request to the bank. Why does this attack succeed?

A Because the malicious site can read the user's bank session cookies directly.

B Because the bank website does not use HTTPS to encrypt requests.

C Because the user's browser automatically includes the bank's cookies when submitting the hidden form.

D Because the user manually submitted the form on the malicious site.

💡 Hint

Consider how browsers handle cookies and requests across different sites.

Browsers send cookies automatically with requests to the bank, even if the request originates from another site, enabling CSRF.

❓ Comparison

advanced

Comparing CSRF and XSS Attacks

Which statement correctly distinguishes CSRF from Cross-site scripting (XSS)?

A CSRF exploits the website's trust in the user, while XSS exploits the user's trust in a website.

B CSRF injects malicious scripts into a website, while XSS tricks users into submitting unauthorized requests.

C CSRF attacks steal cookies directly, while XSS attacks only cause denial of service.

D CSRF requires user interaction, while XSS does not.

💡 Hint

Think about who is being tricked in each attack type.

CSRF tricks the user’s browser into sending requests the website trusts; XSS injects malicious code into the website to attack users.

❓ Reasoning

expert

Evaluating CSRF Protection Effectiveness

A web application uses the 'SameSite' cookie attribute set to 'Strict' for session cookies. What is the expected impact on CSRF attacks?

A CSRF attacks will be prevented because cookies are not sent with cross-site requests.

B CSRF attacks will increase because 'SameSite=Strict' allows all cross-site cookies.

C CSRF attacks will be prevented only if HTTPS is also used.

D There will be no impact because 'SameSite' only affects cookie encryption.

💡 Hint

Consider how the 'SameSite' attribute controls cookie behavior in cross-site requests.

'SameSite=Strict' prevents cookies from being sent with requests initiated by third-party sites, blocking CSRF attempts.

Practice

1. What is the main goal of a Cross-site request forgery (CSRF) attack?

easy

A. To encrypt user data for ransom

B. To steal a user's password by phishing

C. To overload a website with traffic causing it to crash

D. To trick a logged-in user into performing unwanted actions on a website

Solution

1. Step 1: Understand CSRF attack purpose

   CSRF attacks aim to make a user unknowingly perform actions they did not intend on a trusted website.

2. Step 2: Compare with other attack types

   Phishing steals passwords, DoS overloads servers, and ransomware encrypts data, which are different from CSRF.

3. Final Answer:

   To trick a logged-in user into performing unwanted actions on a website -> Option D

4. Quick Check:

   CSRF = trick user actions [OK]

Hint: CSRF tricks users into unwanted website actions [OK]

Common Mistakes:

• Confusing CSRF with phishing attacks
• Thinking CSRF steals passwords directly
• Mixing CSRF with denial-of-service attacks

2. Which of the following is a common method to protect a website against CSRF attacks?

easy

A. Blocking all cookies from the browser

B. Encrypting all user passwords with SHA-1

C. Using secret tokens that must be submitted with requests

D. Disabling JavaScript on the website

Solution

1. Step 1: Identify CSRF protection techniques

   Websites use secret tokens (CSRF tokens) that must be included in requests to verify they come from the user intentionally.

2. Step 2: Eliminate unrelated options

   Encrypting passwords, blocking cookies, or disabling JavaScript do not specifically prevent CSRF attacks.

3. Final Answer:

   Using secret tokens that must be submitted with requests -> Option C

4. Quick Check:

   CSRF protection = secret tokens [OK]

Hint: CSRF defense uses secret tokens in requests [OK]

Common Mistakes:

• Thinking password encryption stops CSRF
• Believing blocking cookies prevents CSRF
• Assuming disabling JavaScript is a CSRF fix

3. Consider this scenario: A user is logged into their bank website. An attacker sends a hidden form on another site that submits a money transfer request to the bank without the user's knowledge. Which security measure would stop this CSRF attack?

medium

A. The bank requires a unique CSRF token with each form submission

B. The bank uses HTTPS for all pages

C. The bank requires a strong password

D. The bank limits login attempts

Solution

1. Step 1: Analyze the attack method

   The attacker tricks the user into submitting a form without their consent, typical of CSRF.

2. Step 2: Identify effective defense

   Requiring a unique CSRF token ensures the form submission is legitimate and from the user, blocking forged requests.

3. Final Answer:

   The bank requires a unique CSRF token with each form submission -> Option A

4. Quick Check:

   CSRF blocked by unique tokens [OK]

Hint: Unique CSRF tokens stop forged form submissions [OK]

Common Mistakes:

• Thinking HTTPS alone stops CSRF
• Believing strong passwords prevent CSRF
• Confusing login limits with CSRF defense

4. A developer wrote this code snippet to protect against CSRF:

<form method="POST" action="/transfer">
  <input type="hidden" name="csrf_token" value="12345" />
  <input type="submit" value="Send" />
</form>

Why might this code still be vulnerable to CSRF attacks?

medium

A. The form uses POST method instead of GET

B. The CSRF token is static and not unique per user session

C. The form does not include a CAPTCHA

D. The form action URL is relative

Solution

1. Step 1: Examine the CSRF token usage

   The token value "12345" is hardcoded and does not change per user or session, making it predictable.

2. Step 2: Understand CSRF token requirements

   Effective CSRF tokens must be unique and unpredictable per user session to prevent attackers from guessing them.

3. Final Answer:

   The CSRF token is static and not unique per user session -> Option B

4. Quick Check:

   Static tokens fail CSRF protection [OK]

Hint: CSRF tokens must be unique per session, not static [OK]

Common Mistakes:

• Thinking POST method alone prevents CSRF
• Assuming CAPTCHA is required for CSRF defense
• Believing relative URLs cause CSRF vulnerabilities

5. A website uses cookies for user sessions but does not implement CSRF tokens. An attacker crafts a malicious link that triggers a fund transfer when clicked by a logged-in user. How can the website improve security to prevent this CSRF attack without removing cookies?

hard

A. Implement a unique CSRF token that must be submitted with sensitive requests

B. Switch all requests to use GET method instead of POST

C. Require users to re-enter their password on every page load

D. Disable cookies and use URL parameters for sessions

Solution

1. Step 1: Identify the vulnerability

   Cookies alone do not prevent CSRF because browsers send them automatically with requests, allowing forged actions.

2. Step 2: Choose effective mitigation

   Adding unique CSRF tokens ensures that only legitimate requests from the user are accepted, blocking forged requests.

3. Final Answer:

   Implement a unique CSRF token that must be submitted with sensitive requests -> Option A

4. Quick Check:

   Unique tokens prevent CSRF despite cookies [OK]

Hint: Add unique CSRF tokens to protect cookie-based sessions [OK]

Common Mistakes:

• Thinking GET requests are safer than POST
• Believing password re-entry on every page is practical
• Assuming disabling cookies is the only fix