A security analyst recently used Arachni to perform a vulnerability assessment of a newly developed web application. The analyst is concerned about the following output: [+] XSS: In form input…

Question

Options

• AThe developer set input validation protection on the specific field of search.aspx.
• BThe developer did not set proper cross-site scripting protections in the header.
• CThe developer did not implement default protections in the web application build.
• DThe developer did not set proper cross-site request forgery protections.

• A
  5% (1)
• B
  73% (16)
• C
  18% (4)
• D
  5% (1)

Explanation

Explanation

Option B is correct because the Arachni output confirms an XSS (Cross-Site Scripting) vulnerability in the search form, which most commonly occurs when developers fail to set proper security headers (such as Content-Security-Policy or X-XSS-Protection) that instruct browsers to block malicious script injection attempts. Option A is incorrect because it describes a protective measure (input validation), not a failure - if validation were in place, the vulnerability likely wouldn't exist. Option C is a vague distractor; while default protections matter, the specific finding points to a header-level control gap, not a broad framework omission. Option D is incorrect because CSRF (Cross-Site Request Forgery) is an entirely different vulnerability class involving unauthorized requests on behalf of authenticated users, unrelated to the XSS finding shown.

Memory Tip: Think "XSS = Headers Shield the Browser" - XSS protections live in HTTP response headers (e.g., Content-Security-Policy), so when XSS is found, think missing headers first. CSRF is about forged requests, XSS is about injected scripts - don't mix them up!

No community discussion yet for this question.