NSE5-FWB-AD-8-0: Fortinet NSE 5 - FortiWeb 8.0 Administrator

By Fortinet · Question Mode

QuestionQ41

VerifiedWeb application and API security with botnet mitigation

You are reviewing a report from your FortiWeb logs and notice that a JavaScript payload such as <script>document.cookie</script> was submitted through a product review form. The page does not filter the script, and when users view the review, their session cookies are exposed.

Why is this attack dangerous?

Explanation

An unfiltered script embedded in user-supplied content is stored XSS. When the affected page renders, the victim’s browser executes the attacker-controlled JavaScript in the site’s context, enabling actions such as reading accessible session cookies. Fortinet documents that XSS causes a browser to execute client-side script and that such scripts can steal cookies.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!