Cross-Site Request Forgery (CSRF) - GET and POST Methods WAHS Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A penetration tester is evaluating the impact of a CSRF vulnerability in an application that allows users to change their shipping address. The application uses anti-CSRF tokens. The tester discovers that the token is generated based on the user's email address and is predictable. Which action should the tester take to exploit this?

   • AUse a cross-site scripting attack to read the token
   • BCalculate the token using the victim's email address and include it in a forged request
   • CUse a brute-force attack to guess the token
   • DPerform a session fixation attack to set the victim's session
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An attacker wants to perform CSRF against a user of a web application that changes the user's shipping address via a GET request. The user is currently authenticated. Which sequence of steps correctly describes the CSRF attack flow?

   • AThe attacker sends a phishing email with a link, the victim enters credentials on the attacker's site, and the attacker uses those credentials to change the address.
   • BThe attacker first steals the victim's session cookie, then replays it to send the address change request.
   • CThe attacker crafts a malicious link or image tag, the victim clicks it while authenticated, the browser sends the request with the session cookie, and the server processes the address change.
   • DThe victim visits the attacker's site, the attacker's server sends a request directly to the application using the victim's IP address, and the server updates the address.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is assessing the impact of a CSRF vulnerability in a web application. The application allows users to update their profile information, including email address, via a GET request. Which of the following is the most likely impact of a successful CSRF attack?

   • AThe attacker can execute arbitrary code on the victim's browser.
   • BThe attacker can read the victim's profile data from the response.
   • CThe attacker can steal the victim's session cookie.
   • DThe attacker can change the victim's email address, potentially leading to account takeover if password reset is sent to the new email.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security architect is designing CSRF defenses for a multi-tenant web application. The application uses a shared domain for all tenants (e.g., app.example.com) and relies on session cookies. Some tenants require embedding the application in iframes on their own sites. Which CSRF defense would be most appropriate?

   • AUse SameSite=None with anti-CSRF tokens and validate the Origin header
   • BUse Referer header validation only
   • CUse SameSite=Strict and allow iframe embedding
   • DUse only anti-CSRF tokens without SameSite
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A web application uses anti-CSRF tokens that are stored in a cookie and also submitted as a hidden form field. The server validates that the cookie value matches the form value. An attacker finds a reflected XSS vulnerability in the same application. How does this affect CSRF protection?

   • AThe XSS vulnerability allows the attacker to read the token and perform CSRF attacks
   • BThe CSRF protection remains effective because the token is not readable by JavaScript
   • CThe XSS vulnerability does not affect CSRF because they are separate attacks
   • DThe CSRF protection is strengthened because the token is in a cookie
   Reveal Solution Discussion Select an answer first