Let's say a we have a legitimate website A and a malicious website B.

I am correct in assuming that for malicious site B to target site A with a CSRF it needs to have been created specifically for this purpose?

Meaning such a website couldn't launch CSRF attacks on other websites C, D, etc.

Or could an attacker create a website that makes CSRF attacks against any other website the user has currently open in his browser?

1 Answer 1


A cross-site request forgery attack is only possible if a particlar type of vulnerability on the target website is present, e.g. a missing form submission token. If such a vulnerability has been identified, it can be used to attack a user of the website (not the website itself) which requires a degree of interaction from that user.

The attacker has to make the user trigger the CSRF vulnerability (like you similarly have to make a user trigger an XSS vulnerability). In a basic scenario, the attacker creates an own website that sets up the CSRF attack and send a link to the victim. If the victim falls for the trap and visits the attacker's prepared page, they unwittingly perform a request to the target website in the background which causes an unauthorized action, like involuntarily changing their password.

Every CSRF attack has to be tailored to the specific target and the particular vulnerability. It's not like a DoS attack which you can basically run against any system. It's also a client-side vulnerability that targets a user, not the server itself. The notion of a "website attacking another website" doesn't really apply.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .