课程: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

免费学习该课程！

今天就开通帐号，24,600 门业界名师课程任您挑！

Request forgery

Request forgery

课程: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

开始一个月试用 购买团队方案

Request forgery

“

- [Narrator] Another danger facing web applications is the threat of cross-site request forgery. These attacks are similar to cross-site scripting attacks, but they're even more dangerous. But first, one quick note on terminology. Cross-site request forgery also goes by two different acronyms. Some people call it CSRF, while others use the XSRF acronym. Others even pronounce the acronym and call it "sea surf." All of these terms refer to the same attack. As you may recall, cross-site scripting attacks occur when an attacker exploits a third-party website to include scripts written by the attacker in input shown to other users. The user's web browser then executes that code when it visits the site. Cross-site request forgery attacks go a step further and prey upon the fact that users often have multiple sites open at the same time and they may be logged into many different sites in different browser tabs. As you may have noticed, authenticated sessions crossover between different…

内容