During a penetration test, a tester finds that the web application being analyzed is vulnerable to Cross Site Scripting (XSS). Which of the following conditions must be met to exploit this vulnerabili

The 'Secure' flag controls whether a cookie is sent only over HTTPS connections, not whether JavaScript can read it, so its absence does not directly enable XSS-based cookie theft.

The HttpOnly flag instructs the browser to prevent JavaScript from accessing a cookie via document.cookie. Without this flag, a successful XSS payload can read the victim's session cookie and exfiltrate it to the attacker, enabling session hijacking. This is the primary exploitation path for cookie theft via XSS.

Endpoint security solutions may detect or block malicious activity, but their absence is not a required condition to exploit an XSS vulnerability in a web application.

XSS exploits standard browser JavaScript execution and does not require ActiveX, which is a legacy Microsoft technology unrelated to cross-site scripting.