XSS I

XSS is:

• Injection of commands

• Injection parameters

• Injection of scripts

• All of the above

Which of the following languages are associated with cross-site scripting? [Multiple Choice]

• HTML

• SQL

• XSLT

• JavaScript

Which of the following threats are most likely to be caused by poor input validation?

[Multiple Choice]

• Injection

• XSS

• Weak Cryptography

• Insecure Communication (SSL not implemented)

Which attack can execute scripts in the user’s browser and is capable of hijacking user sessions, defacing websites or redirecting the user to malicious sites?

• SQL Injection

• Malware Uploading

• Man in the middle

• Cross site scripting

By exploiting XSS, an attackers can perform a variety of malicious activities, such as:

[Multiple Choice]

• Hijack an account

• Spread web worms

• Control the browser remotely

• Access browser history and clipboard contents

• Scan and exploit intranet appliances and applications

XSS can be prevented by:

[Multiple Choice]

• Input Validation

• Input Sanitization

• Escaping

<script>document.write("Site is at: " + document.location.href + "."); </script>

This may lead to:

• All types of XSS

• Stored XSS

• Reflected XSS

• DOM based XSS

The picture is an example of:

• Command Injection

• Reflected XSS

• DOM based XSS

• SQL Injection

XSS can be exploited by tampering parameters in GET request

• TRUE

• FALSE

XSS can be exploited by including javascript in POST request

• TRUE

• FASLE