GPEN · Question #36
You work as a Computer Hacking Forensic Investigator for SecureNet Inc. You want to investigate Cross-Site Scripting attack on your company's Website. Which of the following methods of investigation c
The correct answer is A. Review the source of any HTML-formatted e-mail messages for embedded scripts or links in B. Look at the Web servers logs and normal traffic logging. C. Use a Web proxy to view the Web server transactions in real time and investigate any. XSS forensic investigation relies on application-layer techniques - examining HTML email sources, reviewing web server logs, and proxying live transactions - to detect injected scripts; raw packet capture via Wireshark is insufficient because it cannot inspect encrypted HTTPS con
Question
You work as a Computer Hacking Forensic Investigator for SecureNet Inc. You want to investigate Cross-Site Scripting attack on your company's Website. Which of the following methods of investigation can you use to accomplish the task? Each correct answer represents a complete solution. Choose all that apply.
Options
- AReview the source of any HTML-formatted e-mail messages for embedded scripts or links in
- BLook at the Web servers logs and normal traffic logging.
- CUse a Web proxy to view the Web server transactions in real time and investigate any
- DUse Wireshark to capture traffic going to the server and then searching for the requests going
How the community answered
(26 responses)- A77% (20)
- D23% (6)
Why each option
XSS forensic investigation relies on application-layer techniques - examining HTML email sources, reviewing web server logs, and proxying live transactions - to detect injected scripts; raw packet capture via Wireshark is insufficient because it cannot inspect encrypted HTTPS content.
Reviewing the HTML source of email messages can expose embedded malicious scripts or obfuscated links delivered as part of a reflected or phishing-based XSS attack targeting users.
Web server logs record all HTTP request URLs and POST bodies, allowing investigators to identify script-laden payloads or unusual parameter values characteristic of XSS injection attempts.
A web proxy intercepts and presents full HTTP/HTTPS request and response bodies in real time, enabling direct inspection of injected JavaScript or event handler payloads within page content.
Wireshark operates at the network packet level and cannot decrypt HTTPS traffic without the server's private key, making it ineffective for inspecting the application-layer content where XSS payloads are embedded.
Concept tested: XSS forensic investigation methods and tools
Source: https://owasp.org/www-community/attacks/xss/
Topics
Community Discussion
No community discussion yet for this question.