A Security Engineer at a medium-sized accounting firm has been tasked with discovering how much information can be obtained from the firm's public facing web servers. The engineer decides to start by

Cross-site scripting is an active attack that injects malicious client-side scripts into pages viewed by other users, requiring crafted malicious input rather than simply reading a server response header.

The engineer used netcat to connect to port 80 and read the raw HTTP response, which disclosed the server type (Microsoft-IIS/6) and version directly in the Server header. Banner grabbing is a passive information-gathering technique that fingerprints target services without sending malicious payloads, helping attackers identify potentially vulnerable software versions.

SQL injection manipulates database queries by inserting malicious SQL syntax into application input fields, which was not performed here since the engineer only made a basic port connection and read the HTTP response.

A WHOIS query retrieves domain registration and ownership data from a registrar's database, whereas the engineer connected directly to the server's TCP port and read the service response banner.