GIAC
GPEN · Question #449
While performing an assessment on a banking site, you discover the following link: hnps://mybank.com/xfer.aspMer_toMaccount_number]&amount-[dollars] Assuming authenticated banking users can be lured…
Sign in or unlock GPEN to reveal the answer and full explanation for question #449. The question stem and answer options stay visible for context.
Web Application Penetration Testing
Question
While performing an assessment on a banking site, you discover the following link:
hnps://mybank.com/xfer.aspMer_toMaccount_number]&amount-[dollars] Assuming authenticated banking users can be lured to your web site, which crafted html tag may be used to launch a XSRF attack?
Options
- A<imgsrc-"java script alert (`document cookie'):">
- B<scripi>alert('hnps:/'mybank.com/xfer.a$p?xfer_io-[attacker_account]&amoutn-
- C<scripr>document.\write('hTtp$://mybankxom/xfer.a$p?xfer_to-[attacker.accountl &amount-
- D<img src-'https/mybank.com/xfer.asp?xfer_to=[artacker_account]&amount= [dollars]">
Unlock GPEN to see the answer
You've previewed enough free GPEN questions. Unlock GPEN for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#CSRF#cross-site request forgery#HTML injection#web authentication