CSRF vs XSS difference?

CSRF vs XSS difference?

• A. CSRF coerces a user’s browser to perform actions on a site without intent; XSS injects malicious script into web content.
• B. CSRF is about inter-site scripting; XSS is about cross-site request forgery.
• C. CSRF and XSS are the same.
• D. CSRF injects bytes into cookies; XSS stores data in DB.

Answer: (A)

CSRF and XSS describe two different browser-based attack patterns. CSRF targets what the user’s browser does on a site the user is already logged into by tricking the browser into making an unwanted request, leveraging the user’s authenticated session without the user’s explicit intent. XSS, on the other hand, involves injecting malicious script into web content so that the victim’s browser runs that code, allowing the attacker to steal data, modify pages, or take actions on behalf of the user. So the best way to state the distinction is that CSRF coerces a user’s browser to perform actions on a site without the user’s explicit intent, while XSS injects malicious script into web content. The other options mix up the concepts or are incorrect: CSRF is not about inter-site scripting, XSS is not about cross-site request forgery, they are not the same, and they don’t describe injecting bytes into cookies or storing data in a database.

CSRF and XSS describe two different browser-based attack patterns. CSRF targets what the user’s browser does on a site the user is already logged into by tricking the browser into making an unwanted request, leveraging the user’s authenticated session without the user’s explicit intent. XSS, on the other hand, involves injecting malicious script into web content so that the victim’s browser runs that code, allowing the attacker to steal data, modify pages, or take actions on behalf of the user.

So the best way to state the distinction is that CSRF coerces a user’s browser to perform actions on a site without the user’s explicit intent, while XSS injects malicious script into web content. The other options mix up the concepts or are incorrect: CSRF is not about inter-site scripting, XSS is not about cross-site request forgery, they are not the same, and they don’t describe injecting bytes into cookies or storing data in a database.