Exam 312-50v11 topic 1 question 300 discussion

B. Cross-Site Scripting https://crashtest-security.com/xss-vs-csrf-difference/

This question is confusing. Like a lot of this certification. If the attacker inyect this string in the vulner website, first has exwploited a XSS and later a CSRF when victim's web browser render the iframe tag...

The correct option is D CSRF

According ChatGPT it should be Cross-site Scripting. This type of attack is called a "Cross-Site Scripting (XSS) attack". It is a type of web application vulnerability where an attacker injects malicious code into a web page viewed by other users. The malicious code can be in the form of a script, such as JavaScript, which is executed by the victim's browser when they view the affected web page. This can allow the attacker to steal sensitive information, such as login credentials, or perform other malicious actions on the victim's behalf, such as changing their profile information and submitting it to the attacker's database. The attack can be performed using either HTTP GET or HTTP POST methods, depending on the specific vulnerability present in the website.

Web Application Threats - Cross-Site Request Forgery (CSRF) Attack also known as a one-click attack, occurs when a hacker instructs a user’s web browser to send a request to the vulnerable website through a malicious web page.The victim holds an active session with a trusted site and simultaneously visits a malicious site, which injects an HTTP request for the trusted site into the victim user’s session. (P.1798/1782)

Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf) or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the website trusts. Different HTTP request methods, such as GET and POST, have different level of susceptibility to CSRF attacks and require different levels of protection due to their different handling by web browsers. References: https://en.wikipedia.org/wiki/Cross-site_request_forgery