Which of the following Web attacks is performed by manipulating codes of programming languages such as SQL, Perl, Java present in the Web pages?

A code injection attack is a general class of vulnerability where an attacker supplies untrusted input to a program, which is then executed or interpreted as part of a command or query. The question specifically mentions manipulating the code of languages like SQL, Perl, and Java. This directly describes code injection, where the injected data is code written in one of these languages. The vulnerable application mistakenly processes this input as executable code, leading to unauthorized actions. This category includes more specific attacks like SQL injection and server-side code injection involving languages like Perl or Java.

A. Command injection is a specific type of code injection where the goal is to execute arbitrary commands on the host operating system, not necessarily manipulate the application's programming language.

B. Cross-Site Scripting (XSS) is a client-side attack that injects malicious scripts (e.g., JavaScript) into web pages viewed by other users, rather than manipulating server-side code like SQL or Java.

C. Cross-Site Request Forgery (CSRF) is an attack that tricks an authenticated user's browser into sending an unintended, malicious request to a web application; it does not involve code manipulation.

1. OWASP Foundation. (n.d.). Code Injection. OWASP. Retrieved from https://owasp.org/www-community/attacks/CodeInjection.

Reference Detail: The "Overview" section states

"Code Injection is the general term for attack types which consist of injecting code that is then interpreted/executed by the application... When an application is vulnerable to this type of attack

it allows attackers to inject code in the same language of the application itself (e.g. PHP

Python

etc.) or in other languages (e.g. JavaScript

SQL

etc.)." This directly supports that manipulating SQL

Perl

and Java code falls under the general category of Code Injection.

2. MIT OpenCourseWare. (2014). Lecture 10: Web Security. 6.858 Computer Systems Security

Fall 2014. Massachusetts Institute of Technology.

Reference Detail: In the lecture notes (PDF

page 2)

injection attacks are discussed as a major web security problem where "user input is misinterpreted as code/commands." It explicitly covers SQL injection and command injection as primary examples of this broader class of vulnerability

reinforcing that "code injection" is the correct general term.

3. Akhawe

D.

& Wagner

D. (2010). A Security Evaluation of the new HTML5 Geolocation API. University of California

Berkeley

Electrical Engineering and Computer Sciences. UCB/EECS-2010-10.

Reference Detail: Section 2.1

"Web Application Vulnerabilities

" describes code-injection attacks: "In a code-injection attack

an attacker provides malicious input to a web application

which the application then executes as code. Common examples include SQL injection and cross-site scripting (XSS)." This academic source classifies attacks on languages like SQL as a form of code injection.