ITPEC FE Morning October 2023 Question 35
Which of the following is a method for embedding a malicious java script code in the content sent to a victim’s web browser from a vulnerable website?
Explanation
Cross-site scripting — the attacker's script is reflected or stored by a vulnerable site and delivered to the victim's browser inside the site's own page.
The site outputs user-supplied input into HTML without escaping it. A script planted in that input then arrives in the victim's browser as part of a trusted page and runs with that site's privileges, for example stealing its session cookie.
Answer (b)
Why not others:
- •(a) Cross-site request forgery — makes the victim's browser send an unintended request to a site where the victim is logged in; it does not inject script into the site's content
- •(c) OGNL injection — injects expressions into the OGNL language of Java frameworks such as Apache Struts, running code on the server
- •(d) SQL injection — injects SQL into a database query, attacking the database, not the browser
Key rule: Ask where the injected code runs: XSS in the victim's browser, SQL injection in the database, OGNL injection on the application server.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.