GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ705

Web Application Injection Attacks

An attacker wants to steal browser cookies using a Cross-Site Scripting attack. Which website offers the best attack vector?

  • A A user-generated message board
  • B A login page protected by Basic Authentication
  • C A news aggregator RSS feed in XML format
Explanation

A user-generated message board is the strongest vector because it can store attacker-supplied content and render it to other users, enabling stored XSS when input is handled unsafely. XSS can execute script in a victim’s browser and steal cookies that are accessible to client-side JavaScript; the HttpOnly attribute prevents such script access.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!