GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ191

Web Application Injection Attacks

How can an attacker bypass client-side filtering of user input?

  • A By using a web proxy tool
  • B By disabling unsigned Active X controls in Internet Explorer
  • C By cracking SSL keys
  • D By breaking into the web server and disabling filtering
Explanation

A web proxy tool can intercept and modify requests after browser-side filtering or validation has run, allowing arbitrary input to be sent to the server. Client-side controls are therefore not a security boundary; server-side validation is required.

Community Discussion

No comments yet. Be the first to start the discussion!