Which of the following injects malicious scripts into a trusted website to infect a target?

Cross-site scripting (XSS) is a type of injection attack where malicious scripts are injected into otherwise benign and trusted websites. The attack occurs when an attacker uses a web application to send malicious code, generally in the form of a browser-side script, to a different end user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script, allowing it to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.

A. Malicious code is a general term. XSS is a specific attack vector that uses malicious code, making it the more precise answer.
C. A denial-of-service attack aims to make a system or network unavailable to its intended users, not to inject scripts.
D. A structure query language (SQL) attack targets the back-end database by injecting malicious SQL statements, not client-side scripts into a website.

1. ISACA. (2019). Cybersecurity Fundamentals Study Guide, 2nd Edition. Page 68. The guide defines XSS as an attack that "injects scripts into a web application server to direct attacks at unsuspecting clients."

2. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Lecture 15: Web Security. The lecture notes define XSS as an attack where "the attacker injects script code into a page from site S," which is then executed by the victim's browser in the context of site S.

3. Johns Hopkins University. (2016). Course: CS 460/660: Introduction to Database Systems. Module on Web Application Security. It describes XSS as a vulnerability where "an attacker can inject some malicious Javascript code into the HTML content generated by your site."