24

I know about cross-site scripting and cross-site request forgery. I want to know if there is any similarity between them?

closed as unclear what you're asking by Abe Miessler, techraf, S.L. Barth, Stephane, Steffen Ullrich Oct 7 '16 at 12:50

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Spell out your confusion in detail. You cannot ask us to write two tutorials for you. – Jan Doggen Oct 6 '16 at 19:53
  • 1
    A quora answer to a very similar question. – Oren Milman Oct 27 '18 at 7:11
47

In a cross-site request forgery attack, the attacker tries to force/trick you into making a request which you did not intend. This could be sending you a link that makes you involuntarily change your password. A malicious link could look like that:

https://security.stackexchange.com/account?new_password=abc123

In a cross-site scripting attack, the attacker makes you involuntarily execute client-side code, most likely Javascript. A typical reflected XSS attacking attempt could look like this:

https://security.stackexchange.com/search?q="><script>alert(document.cookie)</script>

Both attacks have in common that they are client-side attacks and need some form of user activity (e.g. clicking a link or visiting a website). Unlike RFI or SQLi vulnerabilities, you're attacking a user rather than the server. XSS is generally more powerful than CSRF because it usually allows the execution of arbitrary script code while CSRF is restricted to a particular action (e.g. changing the password). As @Lukas points out, a successful XSS attack also effectively bypasses all anti-CSRF measures.

  • 4
    Good answer! I'd like to add that each most XSS vulnerabilities could also be used to exploit CSRF vulnerabilities. – Lukas Oct 6 '16 at 20:30
  • 1
    Would it be right to say, CSRF sends an illegitimate request to perform some operation on the server and XSS sends an illegitimate request so that the response runs client side attack code? – ProgramCpp Jun 6 '17 at 7:04
  • 2
    @ProgramCpp Kind of. XSS is not necessarily about sending a single "illegitimate" request. E.g., with a persistent XSS vulnerability, the attacker could also prepare an attack independent from the victim. But yes, CSRF is about performing an operation, XSS is about running client-side attack code. – Arminius Jun 6 '17 at 8:39
  • For more information about "a successful XSS attack also effectively bypasses all anti-CSRF measures", I think that this is a good resource: owasp.org/index.php/… – Oren Milman Feb 5 at 11:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.