GCFA · Question #31
You work as a Web developer for ABC Inc. You want to investigate the Cross-Site Scripting attack on your company's Web site. Which of the following methods of investigation can you use to accomplish…
The correct answer is A. Review the source of any HTML-formatted e-mail messages for embedded scripts or links in the URL B. Look at the Web server's logs and normal traffic logging. D. Use a Web proxy to view the Web server transactions in real time and investigate any communication. Investigating XSS attacks requires examining HTTP-layer content through logs, proxies, and email source inspection - not raw packet capture with Wireshark, which cannot adequately decode application-layer XSS payloads, especially over HTTPS.
Question
You work as a Web developer for ABC Inc. You want to investigate the Cross-Site Scripting attack on your company's Web site. Which of the following methods of investigation can you use to accomplish the task? Each correct answer represents a complete solution. Choose all that apply.
Options
- AReview the source of any HTML-formatted e-mail messages for embedded scripts or links in the URL
- BLook at the Web server's logs and normal traffic logging.
- CUse Wireshark to capture traffic going to the server and then searching for the requests going to the
- DUse a Web proxy to view the Web server transactions in real time and investigate any communication
How the community answered
(56 responses)- A77% (43)
- C23% (13)
Why each option
Investigating XSS attacks requires examining HTTP-layer content through logs, proxies, and email source inspection - not raw packet capture with Wireshark, which cannot adequately decode application-layer XSS payloads, especially over HTTPS.
Reviewing HTML-formatted email source can reveal embedded scripts or crafted URLs containing XSS payloads, since reflected XSS attacks are often delivered through phishing links.
Web server logs record all inbound HTTP requests including query strings and POST data where XSS payloads are injected, making them a primary forensic artifact.
Wireshark captures raw network packets and cannot decrypt HTTPS traffic without private keys, making it ineffective for inspecting the application-layer payloads where XSS scripts are embedded in modern web traffic.
A web proxy such as Burp Suite operates at the HTTP/HTTPS application layer and can intercept, decrypt, and display full request and response content in real time, making it the most effective tool for live XSS investigation.
Concept tested: Cross-Site Scripting attack investigation methods
Source: https://owasp.org/www-community/attacks/xss/
Topics
Community Discussion
No community discussion yet for this question.