What is the main goal of Cross-Site Scripting (XSS) attacks?

Question

Options

• ATo gain administrative access to a server
• BTo trick users into executing malicious scripts in their browsers
• CTo perform a denial of service on a web server
• DTo alter network traffic flow

• A
  3% (1)
• B
  94% (33)
• D
  3% (1)

Explanation

B is correct because XSS attacks inject malicious scripts into web pages that victims load in their browsers - the attacker's goal is to execute code in the user's context, allowing session hijacking, credential theft, or redirecting users to malicious sites.

Why the distractors are wrong:

• A (admin access) describes privilege escalation or server-side exploits like SQL injection or RCE - XSS targets the client, not the server.
• C (denial of service) is the goal of DoS/DDoS attacks, which flood servers with traffic - XSS doesn't disrupt availability.
• D (alter network traffic) describes man-in-the-middle (MitM) attacks - XSS doesn't intercept or reroute packets.

Memory tip: Think of XSS as "Cross-Site Scripting" - the key word is script. The attack is always about injecting and running a script in someone else's browser. If the attack doesn't involve a browser executing code, it's not XSS.

No community discussion yet for this question.