GSLC: GIAC Security LeadershipDemo

Question

An attacker finds an XSS vulnerability on the website www.vulnerability.com. The attacker emails several prospective victims a link that exploits this XSS vulnerability.

What role does the application server for www.vulnerability.com have in this attack?

A Stores the XSS code in the website’s backend database
B Sends the XSS code results back to the attacker’s host
C Executes the XSS code on the front end web server
D Echoes the XSS code back to the victim’s browser

Explanation

In reflected XSS, a malicious link carries attacker-controlled input to the vulnerable application, which includes that input in its response without proper validation or output encoding. The application server therefore reflects, or echoes, the XSS payload to the victim’s browser, where the browser executes it.

Learn more

GSLC: GIAC Security LeadershipDemo

AstroTutor

Notes

Readiness

QuestionQ59

Community Discussion