The attack described is Cross-Site Request Forgery (CSRF or XSRF). In this attack, an attacker tricks an authenticated user's browser into sending a forged, malicious request to a trusted website. The provided tag, when loaded by the victim's browser (likely on a malicious site), silently sends a request to updateif.php on vulnweb.com. Because the victim is presumably logged into vulnweb.com, their browser automatically includes their session cookies, making the request appear legitimate to the server. The server then processes the request, changing the user's profile without their knowledge or consent.

A. Browser Hacking: This is a generic, non-standard term. While the browser is the medium for the attack, "Browser Hacking" is not the specific name for this type of web application vulnerability.
B. Cross-Site Scripting: XSS involves injecting malicious scripts that execute within the victim's browser in the context of the trusted site, whereas CSRF forges a request from the browser to the trusted site.
C. SQL Injection: This attack targets the back-end database by injecting malicious SQL queries into application inputs. The provided HTML code does not contain any SQL commands.

1. Pessina

F.

& Tiozzo

G. (2020). Web Application Security. In Politecnico di Milano Courseware

Computer Security

A.Y. 2019-2020. Section 4.2

"Cross-Site Request Forgery (CSRF)

" p. 11. This document describes CSRF as an attack that "forces a logged-on victim's browser to send a forged HTTP request... to a vulnerable web application." It explicitly mentions that GET requests can be triggered by tags like

etc.

2. Johns

M. (2008). Breaking the Web's Cookie Jar: Cross-Site Request Forgery and its Mitigation. In Security and Privacy in Communications Networks and the Workshops

2008. SecureComm 2008. Fourth International Conference on (pp. 1-10). IEEE. Section II.A

"The Attack

" describes how CSRF works by tricking a browser into issuing a request

noting that "any HTML element that can trigger a GET request to a third-party site can be used

" which includes . DOI: 10.1109/SecureComm.2008.38

3. Barth

A.

Jackson

C.

& Mitchell

J. C. (2008). Robust Defenses for Cross-Site Request Forgery. In Proceedings of the 15th ACM conference on Computer and communications security (pp. 75-88). Section 2

"Background

" defines CSRF as an attack where "the attacker causes the user's web browser to issue a request to the target site." The paper discusses how requests can be initiated via various HTML tags. DOI: 10.1145/1455770.1455782