A penetration tester is testing a web application for Cross-Site Request Forgery (CSRF) vulnerabilities. What condition must exist for a CSRF attack to be possible?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal: CSRF works when the app trusts browser-sent cookies or session tokens for state-changing requests and doesn't require an unpredictable token the attacker can't forge. You're exploiting automatic credential sending, not broken transport or database flaws.
Full Explanation
CSRF is possible when the application relies on browser-sent credentials such as cookies or session tokens for state-changing requests and does not require an unpredictable token in those requests that an attacker cannot forge. In that condition, the victim's browser automatically includes the authenticated session when the attacker tricks it into submitting a request, so the server accepts the action as legitimate. The condition that the application must not use HTTPS, allowing the attacker to intercept traffic, is wrong because CSRF can occur over HTTPS; the vulnerability is about authentication credentials being auto-sent, not transport encryption. The condition that the application must have SQL injection vulnerabilities in its backend database is wrong because SQL injection is a separate vulnerability class; CSRF does not require database vulnerabilities. The condition that the attacker must have access to the victim's browser history is wrong because browser history is irrelevant to CSRF; the attack only requires the victim to have an active session and be tricked into loading attacker-controlled content.