This classification matters the evolution of CSRF attacks up to 2010. It is not up-to-date and your critics are welcome. It ist meant as attachment to my B.Sc. thesis from 2010. The thesis is presented to the Department of Electrical Engineering and Information Sciences of the Ruhr-University of Bochum Chair of Network and Data Security of the Ruhr-University of Bochum, Horst-Görtz Institute, Prof. Jörg Schwenk

1. CSRF Classification
Classification Implementation/
parameters Techniques
Extracting data
Adding or modifying data
Intent
Compromising Web Site' s/ Web Application's reputation
Compromising Internet transactions
Spam
Compromising Router/ Firewall rules
Input Source Same Origin attacks
Cross Origin Attacks
<img>- Tag
Logout- link
Static CSRF 'Session riding'
Token- manipulation
Techniques
<iframe> - Tag
<script>- Tag
XMLHttpRequest - Object
HTTP Redirect
HTTP Redirect
Dynamic CSRF HTML- based
Token fixation Dynamic CSRF
POST- based Dynamic CSRF
Compounded CSRF 'Samy'- worm
Fast-fluxing SQLIA
Table 1: Classification of the CSRF attacking vector
K.Deltchev, Krassen.Deltchev@rub.de