Judy created a forum, one day. she discovers that a user is posting strange images without writing comments. She immediately calls a security expert, who discovers that the following code is hidden behind those images: What issue occurred for the users who clicked on the image?

Question

Accepted Answer

D. This php file silently executes the code and grabs the users session cookie and session ID. The injected script uses document.cookie to capture the active session cookie and transmits it to a remote PHP endpoint (submitcookie.php) via a hidden image src request, effectively stealing the session ID without user awareness. This allows the attacker to hijack authenticated sessions by replaying the stolen cookie.

Answer

A. The code inject a new cookie to the browser. The code reads existing cookies via document.cookie but never writes or injects new cookies into the browser.

Answer

B. The code redirects the user to another site. No redirect occurs - the attack silently exfiltrates cookie data through a crafted image src request without navigating the browser to another site.

Answer

C. The code is a virus that is attempting to gather the users username and password. The script targets session cookies specifically, not login credentials such as username and password, and it is a stored XSS payload rather than a self-replicating virus.

Judy created a forum, one day. she discovers that a user is posting strange images without writing comments. She immediately calls a security expert, who discovers that the following code is hidden be

Question

Options

How the community answered

Why each option

Topics

Community Discussion