Difference between XSS and CSRF

Key Difference: XSS and CSRF are two types of computer security vulnerabilities. XSS stands for Cross-Site Scripting. CSRF stands for Cross-Site Request Forgery. In XSS, the hacker takes advantage of the trust that a user has for a certain website. On the other hand, in CSRF the hacker takes advantage of a website’s trust for a certain user’s browser.

XSS stands for Cross-Site Scripting. Cross Site Scripting is a security exploit in which a malicious hacker inserts scripts into a dynamic form. It is now being considered as the most common security vulnerability that is found in websites. In XSS, a hacker injects a malicious client-side script into a website. This script is added to cause some form of vulnerability to a victim.

Attackers or hackers use JavaScript, VBScript, ActiveX, HTML or Flash for this purpose. Once the attack is successful, the hacker can cause harm in many ways. For example, the attacker may hijack the account or even change the user’s settings. A common example of XSS can be seen where a malicious link is used for that purpose. A link containing a hidden malicious code is created, and the user is asked to click on it. If the user clicks it, the malicious code gets executed on the client’s web browser.

Cross-site scripting attacks can be broadly divided into two types-

• Persistent – In this type of vulnerability, the malicious data is stored permanently on a database and is later accessed and run by the victims without having any knowledge of it.
• Non-persistent – In this type of vulnerability, the data provided by the malicious hacker is used at that particular instance without any delay.

CSRF stands for Cross-Site Request Forgery. It is also known as one-click attack or session riding. It takes advantage of the targeted website’s trust on a user. A malicious attack is designed in such a way that a user sends malicious requests to the target website without having the knowledge of the attack. A number of tasks can be performed by an attacker making use of CSRF, for example, some content can be posted to a message board, stocks can be traded and even an e-card can be mailed. One of the most common ways to carry out a CSRF attack is to use a HTML image tag or a JavaScript image object.

This kind of vulnerability is not only limited to browsers. The malicious scripting can also be done through a word document, Flash file, movie, etc. Some of the important features of CSRF include –

• It is not mandatory for the victim to be logged in as it depends upon the intention of the attacker.
• Multiple requests can be generated by the attacker to the target site.
• It works extremely well with other types of attacks.
• Generally, the data from the attacked site cannot be read by the attacker and this serves as a limitation for CSRF.

Comparison between XSS and CSRF:

	XSS	CSRF
Full Form	Cross-Site Scripting	Cross-Site Request Forgery
Definition	In XSS, a hacker injects a malicious client side script in a website. This script is added to cause some form of vulnerability to a victim.	It takes advantage of the targeted website’s trust in a user. A malicious attack is designed in such a way that a user sends malicious requests to the target website without having knowledge of the attack.
Dependency	Injection of arbitrary data by data that is not validated	On the functionality and features of the browser to retrieve and execute the attack bundle
Requirement of JavaScript	Yes	No
Condition	Acceptance of the malicious code by the sites	Malicious code is located on third party sites
Vulnerability	A site that is vulnerable to XSS attacks is also vulnerable to CSRF attacks	A site that is completely protected from XSS types of attacks is still most likely vulnerable to CSRF attacks.