ITPEC FE Morning October 2023 Question 35
ITPEC FE Morning October 2023 — Question 35 of 80
Cross-site scripting (XSS) — identifies the attack that injects malicious JavaScript into content served to a victim's browser.
XSS works by embedding script tags or JS payloads into a vulnerable website's output (e.g., unsanitized user input reflected back in HTML). The victim's browser receives and executes the malicious code as if it came from the trusted site.
Why not others:
- (a) CSRF — tricks the victim's browser into sending unauthorized requests to another site; no script is injected into page content
- (c) OGNL injection — exploits Java-based frameworks (e.g., Apache Struts) via expression language; unrelated to JS in browser content
- (d) SQL injection — targets the database via malicious SQL in input fields; does not inject JS into browser content
Key rule: XSS = malicious JS injected into page content delivered to the victim's browser.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.