350-701 · Question #699
What are two targets in cross-site scripting attacks? (Choose two.)
The correct answer is D. header E. image. Cross-site scripting (XSS) attacks often target web page elements like HTTP headers and <img> tags to inject malicious scripts, manipulate content, or exfiltrate sensitive data.
Question
What are two targets in cross-site scripting attacks? (Choose two.)
Options
- Afooter
- Bcookie
- Cinput
- Dheader
- Eimage
How the community answered
(23 responses)- B4% (1)
- C4% (1)
- D91% (21)
Why each option
Cross-site scripting (XSS) attacks often target web page elements like HTTP headers and `<img>` tags to inject malicious scripts, manipulate content, or exfiltrate sensitive data.
While an XSS script can certainly manipulate the content of a footer element, it is a general HTML element rather than a specific attack vector or common target for data theft in the same way as cookies or specific header manipulations.
While stealing cookies is a very common *outcome* or *objective* of an XSS attack, the cookie itself is primarily data that is targeted for theft, rather than a "target" for script injection or manipulation in the same structural sense as an HTML element or header.
Input fields are typically the *source* of the vulnerability where unsanitized user input allows the XSS script to be injected, rather than being the direct *target* that the malicious script operates on or steals, although a script could modify an input field.
XSS attacks can target HTTP headers (e.g., by manipulating Referer or other headers in reflective XSS scenarios, or by using scripts to read/write custom headers in AJAX requests) or elements within the HTML <head> section, injecting malicious scripts or content.
The <img> tag is a common target and vector for XSS attacks, where malicious scripts can be injected into attributes like onerror or src to execute code when the image fails to load or to manipulate the displayed content.
Concept tested: XSS Attack Vectors and Targets
Source: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
Topics
Community Discussion
No community discussion yet for this question.