A victim is logged onto a popular home router forum site in order to troubleshoot some router configuration issues. The router is a fairly standard configuration and
has an IP address of 192.168.1.1. The victim is logged into their router administrative interface in one tab and clicks a forum link in another tab. Due to clicking the
forum link, the home router reboots. Which of the following attacks MOST likely occurred?

A.
Brute force password attack

B.
Cross-site request forgery

C.
Cross-site scripting

D.
Fuzzing

Explanation:
Cross-Site Request Forgery–also known as XSRF, session riding, and one-click attack– involves unauthorized commands coming from a trusted user to the
website. This is often done without the user’s knowledge, and it employs some type of social networking to pull it off. For example, assume that Evan and Spencer
are chatting through Facebook. Spencer sends Evan a link to what he purports is a funny video that will crack him up. Evan clicks the link, but it actually brings up
Evan’s bank account information in another browser tab, takes a screenshot of it, closes the tab, and sends the information to Spencer. The reason the attack is
possible is because Evan is a trusted user with his own bank. In order for it to work, Evan would need to have recently accessed that bank’s website and have a
cookie that had yet to expire. The best protection against cross-site scripting is to disable the running of scripts (and browser profi les).
Incorrect Answers:
A: A Brute Force attack is usually carried out by software that attempts to guess a password by sending multiple authentication requests will different passwords
until authentication is successful. This is not what is described in this question. Therefore, this answer is incorrect.
C: Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into
Web pages viewed by other users.
Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug- in systems on which they rely. Exploiting one of these, attackers
fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it
has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into
web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the
browser on behalf of the user. Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, Cross- Site Request Forgery exploits the
trust that a site has in a user’s browser. Therefore, this answer is incorrect.
D: Fuzz testing or fuzzing is a software testing technique used to discover coding errors and security loopholes in software, operating systems or networks by
inputting massive amounts of random data, called fuzz, to the system in an attempt to make it crash. If a vulnerability is found, a tool called a fuzz tester (or fuzzer),
indicates potential causes. Fuzz testing was originally developed by Barton Miller at the University of Wisconsin in 1989. This is not what is described in this
question. Therefore, this answer is incorrect.

Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 335
http://searchsecurity.techtarget.com/definition/fuzz-testing