An attacker wishes to steal browser cookies through a Cross-Site Scripting attack. Which website provides the best attack vector?

The correct answer is A. A user-generated message board. The attacker searches for a website that reflects input back to a user. The website must reflect back everything the user types in, including special characters included in scripting languages. The attacker doesn't want an application that filters out scripting characters.

Web Application Attacks & Post-Exploitation

Question

Options

AA user-generated message board
BA login page protected by Basic Authentication
CA news aggregator RSS feed in XML format

How the community answered

(31 responses)

A
87% (27)
B
10% (3)
C
3% (1)

Explanation

The attacker searches for a website that reflects input back to a user. The website must reflect back everything the user types in, including special characters included in scripting languages. The attacker doesn't want an application that filters out scripting characters.

Topics

#cross-site scripting#cookie theft#user-generated content#XSS attack vector

Community Discussion

No community discussion yet for this question.

Full GCIH Practice