EXERCISE 1 — Name the vulnerability (the "who acts?" test)
==========================================================

THE TEST: ask "whose code/action causes the harm?"
  - Attacker's script runs ON the target page -> XSS
  - The victim's BROWSER sends an unwanted request -> CSRF
  - The SERVER is made to send a request -> SSRF

(a) A forum signature containing <script> that steals viewers' cookies.
    VULNERABILITY: XSS (stored/persistent).
    WHY: the attacker's JavaScript actually EXECUTES on the target site, in
    each viewer's same-origin session. It runs code on the page and reads
    document.cookie -> that's script execution on the target = XSS. (The fact
    it can read cookies at all is the XSS giveaway; CSRF can't.)

(b) A hidden form on evil.com that changes your email on a site you're
    logged into.
    VULNERABILITY: CSRF.
    WHY: no attacker code runs on the target site. evil.com merely causes the
    VICTIM'S BROWSER to SEND a credentialed request to the target, which
    rides the existing session. Browser tricked into sending a request =
    CSRF. It's write-only (changes email; can't read the response).

(c) A "fetch preview of this URL" feature pointed at http://localhost:8080/admin.
    VULNERABILITY: SSRF.
    WHY: the attacker supplies a URL and the SERVER fetches it. The server is
    tricked into making a request to an internal resource (localhost admin)
    that the attacker couldn't reach directly. Server makes the request =
    SSRF. No victim browser involved at all.

SUMMARY:
  (a) script on the target page          -> XSS
  (b) victim's browser sends the request -> CSRF
  (c) server makes the request           -> SSRF
  Same "forgery"-sounding family, three different actors, three different
  fixes.