312-39 practice question 8 of 35

An attacker, in an attempt to exploit the vulnerability in the dynamically generated welcome page, inserted code at the end of the company’s URL as follows: http://technosoft.com.com/. Identify the attack demonstrated in the above scenario.

Full set: 100 questions

Answer options

A: Cross-site Scripting Attack Correct answer

B: SQL Injection Attack

C: Denial-of-Service Attack

D: Session Attack

Correct Answer:

A. Cross-site Scripting Attack

Explanation

The scenario demonstrates a Reflected Cross-site Scripting (XSS) attack. The attacker has injected a malicious JavaScript payload (<script>alert(...);</script>) into the URL. When a user clicks this crafted URL, the web server "reflects" this script as part of the dynamically generated page's content. The victim's browser then executes the script because it trusts the content coming from the legitimate domain (technosoft.com). This execution happens in the context of the user's session with the trusted site.

Why Incorrect

B. A SQL Injection attack involves inserting malicious SQL code, not JavaScript, into an input field or URL to manipulate the backend database.
C. A Denial-of-Service attack aims to make a resource unavailable. The provided URL with a simple alert script does not achieve this goal.
D. A Session Attack focuses on hijacking a user's session. While XSS can be a vector for session hijacking (e.g., by stealing cookies), the attack itself is XSS.

References

1. OWASP Foundation. (n.d.). Cross-Site Scripting (XSS). OWASP. Retrieved from owasp.org. This resource defines XSS as an attack where malicious scripts are injected into otherwise benign websites and provides examples similar to the one in the question.

2. Johns Hopkins University. (n.d.). Course: 605.744 - Web Application Security. Courseware materials describe Reflected XSS as an attack where a malicious script is part of the victim's request to a web server (often in the URL), which is then reflected to the victim's browser for execution.

Question breakdown

Tests: Identify web application attacks from indicators in URLs
Difficulty: Easy

Key idea: Cross-site scripting injects script code into a dynamically generated page through user-controlled input, such as URL parameters, that the page reflects back to the user.

How to reach the answer

Clue: 'dynamically generated welcome page' plus code appended to the URL.
A welcome page that echoes a username or parameter from the URL is the classic reflected XSS target.
The script payload appears to have been stripped from the question text, but the scenario still matches reflected XSS.
There is no database query manipulation (SQLi), resource exhaustion (DoS) or session token abuse described.

Each option

ACorrect. Appending script code to the URL of a page that reflects input dynamically is reflected cross-site scripting.
BIncorrect. SQL injection targets backend database queries with SQL syntax, not page output rendered in the browser.
CIncorrect. DoS aims to exhaust resources, and a single crafted URL injecting code is not a DoS indicator.
DIncorrect. Session attacks involve hijacking or fixing session IDs, which the scenario does not mention.

Common trap: Any 'code inserted in URL' scenario tempts candidates to pick SQL injection, but a reflected welcome page signals script injection.

In practice: Analysts look for encoded , javascript: or event-handler strings in web server and WAF logs to detect XSS attempts.

Remember: Code in a URL that is reflected into a dynamic page is XSS; SQL syntax aimed at a database is SQLi.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free 312-39 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test