Which type of attack exploits the trust that a site has in a user's browser?

Question

Options

• ASQL Injection
• BCross-Site Scripting (XSS)
• CPhishing
• DSession Hijacking

• A
  6% (1)
• B
  89% (16)
• C
  6% (1)

Explanation

Important note before the explanation: The question as written - "exploits the trust that a site has in a user's browser" - actually describes CSRF (Cross-Site Request Forgery), not XSS. The classic distinction is:

• XSS exploits the trust a user has in a site (malicious scripts run in the user's browser because the browser trusts the site)
• CSRF exploits the trust a site has in a user's browser (forged requests appear legitimate because the site trusts the browser's cookies/session)

Since CSRF is not among the choices, XSS is the intended answer - but if you encounter this question on a real exam, the phrasing is likely a poorly worded distractor or error in the question bank.

Why the other options are wrong:

• A (SQL Injection) targets a database backend by injecting malicious SQL through input fields - it has nothing to do with browser trust.
• C (Phishing) exploits human trust through deception (fake emails/sites), not browser or site trust relationships.
• D (Session Hijacking) involves stealing or forging an existing session token to impersonate a user - a different mechanism entirely.

Memory tip: Think XSS = X-tra Sneaky Scripts - attackers inject scripts into a page you trust, and your browser runs them. If you see the reversed phrasing (site trusting the browser), that's the CSRF definition - know both for exams.

No community discussion yet for this question.