Cross-site request forgery (CSRF) in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the Nature of CSRF Attacks

What best describes a Cross-site request forgery (CSRF) attack?

A An attacker floods a website with traffic to cause a denial of service.

B An attacker intercepts and reads data sent between a user and a website.

C An attacker injects malicious code into a website to steal user data.

D An attacker tricks a user into submitting a request to a trusted website without their consent.

💡 Hint

Think about how the attacker uses the user's browser to perform actions.

CSRF tricks a user’s browser into sending unwanted requests to a trusted site where the user is authenticated, without their knowledge.

📋 Factual

intermediate

Common Defense Mechanisms Against CSRF

Which of the following is a common and effective defense against CSRF attacks?

A Using CAPTCHAs on all form submissions.

B Implementing CSRF tokens that are unique per user session.

C Encrypting all website traffic with HTTPS.

D Blocking all cookies from being sent by the browser.

💡 Hint

Look for a method that verifies the legitimacy of requests from the user.

CSRF tokens are unique values included in forms or requests that the server checks to confirm the request is genuine.

🔍 Analysis

advanced

Analyzing a CSRF Attack Scenario

A user is logged into their bank website. Meanwhile, they visit a malicious site that contains a hidden form that submits a money transfer request to the bank. Why does this attack succeed?

A Because the malicious site can read the user's bank session cookies directly.

B Because the bank website does not use HTTPS to encrypt requests.

C Because the user's browser automatically includes the bank's cookies when submitting the hidden form.

D Because the user manually submitted the form on the malicious site.

💡 Hint

Consider how browsers handle cookies and requests across different sites.

Browsers send cookies automatically with requests to the bank, even if the request originates from another site, enabling CSRF.

❓ Comparison

advanced

Comparing CSRF and XSS Attacks

Which statement correctly distinguishes CSRF from Cross-site scripting (XSS)?

A CSRF exploits the website's trust in the user, while XSS exploits the user's trust in a website.

B CSRF injects malicious scripts into a website, while XSS tricks users into submitting unauthorized requests.

C CSRF attacks steal cookies directly, while XSS attacks only cause denial of service.

D CSRF requires user interaction, while XSS does not.

💡 Hint

Think about who is being tricked in each attack type.

CSRF tricks the user’s browser into sending requests the website trusts; XSS injects malicious code into the website to attack users.

❓ Reasoning

expert

Evaluating CSRF Protection Effectiveness

A web application uses the 'SameSite' cookie attribute set to 'Strict' for session cookies. What is the expected impact on CSRF attacks?

A CSRF attacks will be prevented because cookies are not sent with cross-site requests.

B CSRF attacks will increase because 'SameSite=Strict' allows all cross-site cookies.

C CSRF attacks will be prevented only if HTTPS is also used.

D There will be no impact because 'SameSite' only affects cookie encryption.

💡 Hint

Consider how the 'SameSite' attribute controls cookie behavior in cross-site requests.

'SameSite=Strict' prevents cookies from being sent with requests initiated by third-party sites, blocking CSRF attempts.