Multiple choice technology security

The amount and the item_id of bid is sent via the URL parameter in a bidding website, a user A sends same link to another user B with the manipulated parameter values, after clicking it the other user B finds out later that a bid has been placed on his behalf.

  1. Identity theft.

  2. XML Injection.

  3. Reflected cross-site scripting.

  4. Cross-site request forgery.
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Cross-site Request Forgery (CSRF) tricks a user into executing unwanted actions on a website where they're authenticated. User B, already logged in, clicks the manipulated link and unknowingly places a bid using their session. Identity theft involves stealing personal information, XML Injection targets XML parsers, and reflected XSS requires script execution in the response.

AI explanation

This is Cross-Site Request Forgery (CSRF): the attacker crafts a URL whose parameters (amount, item_id) perform a state-changing action, then tricks the victim's authenticated browser into loading it. Because the victim is already logged in, the request carries their session credentials and the bid is placed without their knowledge. It's not XSS because no script is injected or reflected back, and it's not identity theft since the attacker never steals credentials.

Keep practicing — related questions