Topic starter
| Feature | CSRF | SSRF |
|---|---|---|
| Full Form | Cross-Site Request Forgery | Server-Side Request Forgery |
| Target | Victim user/browser | Vulnerable server |
| Attack Uses | Victim’s authenticated session | Server’s network access |
| Request Origin | User browser | Backend server |
| Goal | Force user action | Make server access internal/external resources |
| Requires Logged-in User? | Usually Yes | No |
| Main Exploit | Trust in browser cookies | Trust in server-side URL fetching |
| Impact | Unauthorized actions | Internal network scan, cloud metadata theft, RCE |
| Common Protection | CSRF tokens, SameSite | URL validation, network restrictions |
Posted : 07/05/2026 11:08 pm
