I've been a little confused about the difference between cross-site scripting (CSS) and cross-site request forgery (CSRF). After some research, I've come up with the following summaries:
- CSS: This attack exploits the trust a user has for a particular website or email. An attacker compromises a website (or crafts an email) with a link that includes malicious code (e.g. HTML code, JavaScript, etc.). When a user selects the link, the malicious code runs on the user’s system, resulting in harm such as the following:
- Opens other webpages, pop-ups, etc.
- Read passwords from web-browser cache
- Steal sensitive data from users’ cookies
- CSRF: This attack exploits the trust a website has for a user’s browser. An attacker compromises a website (or creates an email) with a link that includes malicious code (e.g. HTML code, JavaScript, etc.). When a user selects the link, the malicious code accesses a third-party website (e.g. the user’s bank) that trusts the user’s browser credentials (e.g. session cookie) resulting in harm such as the following: changing profile data (e.g. username, password, email, etc.), transferring money, making purchases, etc.
From what I can tell, both attacks are initiated using similar methods, but the goal (and resulting harm) is different. Please confirm my understanding or help improve my understanding if I'm incorrect.
