Exam CISSP Topic 3 Question 968 Discussion

An attack utilizing social engineering and a malicious Uniform Resource Locator (URL) link to take advantage of a victim's existing browser session with a web application is an example of a cross-site request forgery (CSRF) attack. A CSRF attack is a type of web-based attack that exploits the trust between a web browser and a web server, by tricking the victim into performing an unwanted action on a web application that the victim is already authenticated or authorized to use. For example, a CSRF attack can make the victim transfer funds, change passwords, or delete accounts on a web application, without the victim's knowledge or consent. A CSRF attack typically involves the following steps: The attacker crafts a malicious URL or HTML code that contains a forged request to a web application that the victim is likely to use, such as a banking, shopping, or social media site. The attacker delivers the malicious URL or HTML code to the victim, using social engineering techniques, such as phishing emails, instant messages, or web pages. The victim clicks on the malicious URL or HTML code, which is executed by the victim's web browser. The victim's web browser sends the forged request to the web application, along with the victim's session cookie or token, which authenticates or authorizes the victim to the web application. The web application receives the forged request and executes it, as if it was initiated by the victim. The web application performs the unwanted action, such as transferring funds, changing passwords, or deleting accounts, on behalf of the victim. Cross-Site Scripting (XSS), Injection, and Click jacking are not types of attacks that utilize social engineering and a malicious URL link to take advantage of a victim's existing browser session with a web application. XSS is a type of web-based attack that exploits the vulnerability of a web application, by injecting malicious scripts into the web pages that are viewed by other users. Injection is a type of web-based attack that exploits the vulnerability of a web application, by injecting malicious commands or queries into the user input, such as forms, fields, or URLs. Click jacking is a type of web-based attack that exploits the vulnerability of a web browser, by overlaying a transparent or hidden layer on top of a legitimate web page, and tricking the user into clicking on the hidden layer, which performs an unwanted action on the underlying web page. References: Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 6, Security Assessment and Testing, page 605. CISSP All-in-One Exam Guide, Eighth Edition, Chapter 6, Security Assessment and Testing, page 559.