🕷️

XSS & CSRF: Browser-Based Network Attacks

Medium

Free preview · 2 of 5 steps

Browser trust model: same-origin, cookies, and scripts

Browsers run untrusted web content in a sandbox but give scripts access to resources from the same origin — including session cookies. XSS and CSRF exploit gaps in this trust model: XSS injects scripts that inherit the victim origin's trust; CSRF exploits the browser automatically sending cookies on every request.

Understanding the Same-Origin Policy is the key — it determines what each attack can and cannot do.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step