CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SameSite cookies

  Why it's wrong here

  SameSite cookies mitigate CSRF by restricting when browsers send cookies with cross-site requests. When set to 'Lax' or 'Strict', they prevent cookies from being sent with requests initiated from a different site, which can block many CSRF attacks. However, they are not the best defense because certain attack vectors, such as GET requests that perform state-changing operations or specific browser behaviors, can still bypass their protection, making them less robust than CSRF tokens.

• ✗

  Input validation

  Why it's wrong here

  Input validation is a security measure that ensures data submitted by a user conforms to expected formats, types, and ranges before processing. It is primarily effective against injection attacks like SQL injection or command injection, where malicious input attempts to alter database queries or system commands. However, input validation does not prevent CSRF because CSRF exploits the browser's automatic inclusion of legitimate user credentials (cookies) with a forged request, not the malicious content of the input itself.

• ✗

  Output encoding

  Why it's wrong here

  Output encoding, also known as HTML entity encoding, transforms potentially malicious characters in user-supplied data into their harmless entity equivalents before rendering them in a web page. This process is crucial for preventing Cross-Site Scripting (XSS) attacks, as it stops injected scripts from executing in the user's browser. However, output encoding offers no defense against CSRF, which manipulates a user's browser into sending an authenticated request to a vulnerable application, regardless of the content being displayed.

• ✓

  CSRF tokens

  Why this is correct

  CSRF tokens are unique, unpredictable, and secret values generated by the server and embedded into forms or URLs for state-changing operations. When a user submits a request, the server verifies that the token included in the request matches the one stored in the user's session. This mechanism effectively prevents CSRF attacks because an attacker cannot forge a valid request without knowing the user's unique, session-specific token, which is not accessible to them.

Go deeper

Related to this question