A cross-site request forgery attack is only possible if a particlar type of vulnerability on the target website is present, e.g. a missing form submission token. If such a vulnerability has been identified, it can be used to attack a user of the website (not the website itself) which requires a degree of interaction from that user.
The attacker has to make the user trigger the CSRF vulnerability (like you similarly have to make a user trigger an XSS vulnerability). In a basic scenario, the attacker creates an own website that sets up the CSRF attack and send a link to the victim. If the victim falls for the trap and visits the attacker's prepared page, they unwittingly perform a request to the target website in the background which causes an unauthorized action, like involuntarily changing their password.
Every CSRF attack has to be tailored to the specific target and the particular vulnerability. It's not like a DoS attack which you can basically run against any system. It's also a client-side vulnerability that targets a user, not the server itself. The notion of a "website attacking another website" doesn't really apply.