An attacker has tricked a user into executing content he placed on a social networking site. The malicious content executes in the victim's browser and allows the attacker to determine if machines beh

Cross-Site Scripting occurs when an attacker injects client-side scripts into content served by a trusted site, causing the victim's browser to execute them. Because the script runs in the victim's browser context, it can make requests to internal RFC 1918 addresses behind the victim's firewall, effectively using the browser as a proxy to map internal hosts - a technique known as intranet port scanning via XSS.

SQL Injection targets server-side database queries by manipulating input; it does not execute code in the victim's browser or probe internal networks on the attacker's behalf.

Account Harvesting refers to enumeration techniques used to identify valid user accounts, not script execution in a victim's browser.

Session Hijacking involves stealing or forging authentication tokens to impersonate a user, which is distinct from injecting executable content into a web page.