ITPEC FE Morning April 2020 Question 42

Filtering out input that can be interpreted as a script — XSS works only if user input reaches the page as executable script.

In cross-site scripting, an attacker plants a script in input that a web application echoes back into an HTML page, for example a search term or a comment. The victim's browser runs that script in the site's context and can leak cookies or session IDs. The fix is in the application: remove or escape characters such as <, >, " and ' (sanitizing on output), so that the input is displayed as text instead of being executed.

Answer (c)

Why not others:

• •(a) — not running programs from unknown e-mail senders protects against malware attachments; XSS runs through a legitimate website in the browser
• •(b) — closing unused ports shrinks the attack surface, but XSS arrives through the standard web port that must stay open
• •(d) — HTTPS encrypts traffic in transit; an injected script is delivered over HTTPS just as well and still executes

Key rule: Injection attacks are fixed where the input is interpreted: escape or filter the characters that are special to the target language (HTML and script for XSS, SQL for SQL injection).

Security · AI-written, may contain errors