Which of the following attacks relies on the trust that a website has for a user's browser?

A Cross-Site Request Forgery (CSRF) attack exploits the trust that a web application has in an authenticated user's browser. The attack involves tricking a victim's browser into sending a forged, malicious request to a target website. Because the user is already authenticated with the site (e.g., via a session cookie), the website processes the unauthorized request as if it were a legitimate action initiated by the user. The server trusts that any request coming from that user's browser, accompanied by the correct session cookie, is intentional.

A. Phishing: This is a social engineering attack that exploits a user's trust in a fraudulent entity, not a website's trust in a user's browser.

B. SQL Injection (SQLi): This attack exploits a server's trust in user-supplied data by injecting malicious database commands, not its trust in the browser session itself.

C. Cross-Site Scripting (XSS): This attack exploits the trust a user's browser has in the content from a website, which is the reverse of the scenario described.

1. OWASP Foundation. (n.d.). Cross-Site Request Forgery (CSRF). OWASP Cheat Sheet Series. Retrieved from https://cheatsheetseries.owasp.org/cheatsheets/Cross-SiteRequestForgeryPreventionCheatSheet.html. In the "Introduction" section

it states

"CSRF is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated... the site cannot distinguish between the forged request and a legitimate request."

2. Barth

A.

Jackson

C.

& Mitchell

J. C. (2008). Robust Defenses for Cross-Site Request Forgery. Proceedings of the 15th ACM conference on Computer and communications security. (DOI: https://doi.org/10.1145/1455770.1455782). Section 2

"Background

" describes CSRF as an attack where "the victim’s browser sends a forged request to the honest web site... Because the request is coming from the user’s browser

the request will contain the user’s session cookie."

3. Zeller

D. (2021). CS 253 Web Security

Lecture 4: Same Origin Policy. Stanford University. Slide 43

"Cross-Site Request Forgery (CSRF)

" explicitly states

"The server trusts the browser to only send requests that the user wants." This highlights the core trust relationship exploited by CSRF.