The order is :
Explain the two questions separately, each question on a separate page :
Question 1: The forged HTTP request needs Alice’s user id (guid) to work properly. If Boby targets
Alice specifically, before the attack, he can find ways to get Alice’s user id. Boby does not know
Alice’s Elgg password, so he cannot log into Alice’s account to get the information. Please describe
how Boby can solve this problem.
• Question 2: If Boby would like to launch the attack to anybody who visits his malicious web page.
In this case, he does not know who is visiting the web page beforehand. Can he still launch the CSRF
attack to modify the victim’s Elgg profile? Please explain.