PT0-002 · Question #398
A company developed a new web application to allow its customers to submit loan applications. A penetration tester is reviewing the application and discovers that the application was developed in…
The correct answer is D. Cross-site scripting. The penetration tester discovered a Cross-site Scripting (XSS) vulnerability, as evidenced by the web application executing client-side VBScript code injected into a search form field, resulting in a pop-up message. This occurs when the application fails to properly sanitize…
Question
A company developed a new web application to allow its customers to submit loan applications. A penetration tester is reviewing the application and discovers that the application was developed in ASP and used MSSQL for its back-end database. Using the application's search form, the penetration tester inputs the following code in the search input field:
IMG SRC=vbscript:msgbox ("Vulnerable_to_Attack") ; >originalAttribute="SRC"originalPath="vbscript;msgbox ("Vulnerable_to_Attack ") ;>" When the tester checks the submit button on the search form, the web browser returns a pop-up windows that displays "Vulnerable_to_Attack." Which of the following vulnerabilities did the tester discover in the web application?
Options
- ASQL injection
- BCommand injection
- CCross-site request forgery
- DCross-site scripting
How the community answered
(21 responses)- A5% (1)
- B14% (3)
- C10% (2)
- D71% (15)
Why each option
The penetration tester discovered a Cross-site Scripting (XSS) vulnerability, as evidenced by the web application executing client-side VBScript code injected into a search form field, resulting in a pop-up message. This occurs when the application fails to properly sanitize user input before rendering it in the browser.
SQL injection involves manipulating database queries through input fields, typically resulting in unauthorized data access or modification, not the execution of client-side scripts in a browser pop-up.
Command injection allows an attacker to execute arbitrary commands on the host operating system, which would not manifest as a VBScript pop-up in the user's web browser.
Cross-site request forgery (CSRF) involves tricking a logged-in user into performing unwanted actions on a web application, and it does not involve injecting and executing client-side scripts like the example shows.
Cross-site Scripting (XSS) occurs when an attacker injects malicious client-side scripts, such as JavaScript or VBScript, into web pages viewed by other users. The provided payload, IMG SRC=vbscript:msgbox ("Vulnerable_to_Attack"), demonstrates the injection of client-side VBScript that executes in the user's browser, causing a pop-up, which is a classic indicator of an XSS vulnerability.
Concept tested: Web application vulnerabilities - Cross-site scripting (XSS)
Source: https://owasp.org/www-community/attacks/xss/
Topics
Community Discussion
No community discussion yet for this question.