GIAC
GWAPT · Question #11
During a web application test, you find that the application echoes back input provided in the "Search" field without sanitizing it. How would you test for a potential reflected XSS vulnerability?
The correct answer is A. Inject <script>alert('XSS')</script> into the search field and observe the output. See the full explanation below for the reasoning.
Question
During a web application test, you find that the application echoes back input provided in the "Search" field without sanitizing it. How would you test for a potential reflected XSS vulnerability?
Options
- AInject <script>alert('XSS')</script> into the search field and observe the output
- BPerform a SQL injection using ' OR 1=1 --
- CAttempt to brute-force the admin login page
- DFlood the application with excessive HTTP requests
How the community answered
(34 responses)- A74% (25)
- B15% (5)
- C9% (3)
- D3% (1)
Community Discussion
No community discussion yet for this question.