A network administrator notices a security intrusion on the web server. Which of the following is noticed by file?

Buffer overflow attacks manifest as application crashes, unexpected process termination, or memory corruption events, not as artifacts detectable in standard web server log or application files.

Clickjacking uses invisible iframe overlays to hijack user clicks and is detected through client-side UI analysis or HTTP response header inspection (X-Frame-Options / Content-Security-Policy), not through file examination.

SQL injection attacks target back-end database queries and are primarily detected through database error logs and query logs, not through web server application files alone.

XSS attacks inject malicious client-side scripts into web pages served to users, and evidence of these attacks is found in web server access logs and application files where the injected payloads appear as abnormal script content. Reviewing these files is a standard forensic step during a web server intrusion investigation to identify XSS attack artifacts.