PT0-003 · Question #168
During a discussion of a penetration test final report, the consultant shows the following payload used to attack a system: ?/<sCRitP>aLeRt("pwned")</ScriPt> Based on the code, which of the…
The correct answer is D. XSS obfuscated: should be prevented by input sanitization. XSS Attack Explanation: The payload exploits Cross-Site Scripting (XSS) by injecting obfuscated JavaScript into the When rendered, the browser executes the malicious code (e.g., alert('pwned')). Obfuscation (<sCRitP> instead of <script>) attempts to bypass naive input filters…
Question
During a discussion of a penetration test final report, the consultant shows the following payload used to attack a system:
?/<sCRitP>aLeRt("pwned")</ScriPt> Based on the code, which of the following options represents the attack executed by the tester and the associated countermeasure?
Options
- AArbitrary code execution: the affected computer should be placed on a perimeter network
- BSQL injection attack: should be detected and prevented by a web application firewall
- CCross-site request forgery: should be detected and prevented by a firewall
- DXSS obfuscated: should be prevented by input sanitization
How the community answered
(31 responses)- A3% (1)
- B3% (1)
- C10% (3)
- D84% (26)
Explanation
XSS Attack Explanation: The payload exploits Cross-Site Scripting (XSS) by injecting obfuscated JavaScript into the When rendered, the browser executes the malicious code (e.g., alert('pwned')). Obfuscation (<sCRitP> instead of <script>) attempts to bypass naive input filters. Implement input sanitization to ensure all user inputs are properly validated and escaped before being processed or rendered.
Topics
Community Discussion
No community discussion yet for this question.