A security administrator develops a web page and limits input into the fields on the web page as well as filters special characters in output. The administrator is
trying to prevent which of the following attacks?

A.
Spoofing

B.
XSS

C.
Fuzzing

D.
Pharming

Explanation:
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web
pages viewed by other users.
Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug- in systems on which they rely. Exploiting one of these, attackers
fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it
has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into
web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the
browser on behalf of the user.
By validating user input and preventing special characters, we can prevent the injection of client- side scripting code.
Incorrect Answers:
A: There are several kinds of spoofing including email, caller ID, MAC address, and uniform resource locator (URL) spoof attacks. All types of spoofing are
designed to imitate something or someone.
Email spoofing (or phishing), used by dishonest advertisers and outright thieves, occurs when email is sent with falsified “From:” entry to try and trick victims that
the message is from a friend, their bank, or some other legitimate source. Any email that claims it requires your password or any personal information could be a
trick.
In a caller ID attack, the spoofer will falsify the phone number he/she is calling from. Input validation is not used to prevent spoofing. Therefore, this answer is
incorrect.
C: Fuzz testing or fuzzing is a software testing technique used to discover coding errors and security loopholes in software, operating systems or networks by
inputting massive amounts of random data, called fuzz, to the system in an attempt to make it crash. If a vulnerability is found, a tool called a fuzz tester (or fuzzer),

indicates potential causes. Fuzz testing was originally developed by Barton Miller at the University of Wisconsin in 1989. This is not what is described in this
question. Input validation is not used to prevent fuzzing. Therefore, this answer is incorrect.
D: Similar in nature to e-mail phishing, pharming seeks to obtain personal or private (usually financial related) information through domain spoofing. Rather than
being spammed with malicious and mischievous e-mail requests for you to visit spoof Web sites which appear legitimate, pharming ‘poisons’ a DNS server by
infusing false information into the DNS server, resulting in a user’s request being redirected elsewhere. Your browser, however will show you are at the correct Web
site, which makes pharming a bit more serious and more difficult to detect. Phishing attempts to scam people one at a time with an e-mail while pharming allows
the scammers to target large groups of people at one time through domain spoofing. Input validation is not used to prevent pharming. Therefore, this answer is
incorrect.

http://en.wikipedia.org/wiki/Cross-site_scripting
http://searchsecurity.techtarget.com/definition/fuzz-testing http://www.webopedia.com/TERM/P/pharming.html