ECSA v10: EC-Council Certified Security Analyst v10

By ECCouncil · Question Mode

QuestionQ116

VerifiedWeb Application Penetration Testing Methodology

A recent study by HyThech Technologies found that three of the most popular websites have the most commonly exploitable flaw in their web applications.

By exploiting this vulnerability, an attacker can inject malicious code that executes on a user's machine. The study also revealed that its most sensitive target is session-cookie theft. This enables attackers to duplicate a user session and access anything the user can do on a website, such as manipulating personal information, creating fake social-media posts, stealing credit-card information, and performing unauthorized financial transactions.

Identify the vulnerability revealed by HyThech Technologies?

Explanation

Cross-site scripting (XSS) is an injection vulnerability in which malicious scripts are delivered through a trusted web application and executed by a victim’s browser. The scripts can access session cookies or tokens and enable session hijacking and actions performed with the victim’s authenticated privileges.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!