PrepAway - Latest Free Exam Questions & Answers

Which of the following attack types BEST describes a cl…

Which of the following attack types BEST describes a client-side attack that is used to manipulate an HTML iframe with JavaScript code via a web browser?

PrepAway - Latest Free Exam Questions & Answers

A.
Buffer overflow

B.
MITM

C.
XSS

D.
SQLi

PrepAway - Latest Free Exam Questions & Answers

One Comment on “Which of the following attack types BEST describes a cl…

  1. meac says:

    The questions give us a number of clues
    We are talking about:
    1) A client-side attack that is used to manipulate an HTML iframe
    2) Using JavaScript

    An IFrame (Inline Frame) is an HTML document embedded inside another HTML document on a website. The IFrame HTML element is often used to insert content from another source, such as an advertisement, into a Web page. Although an IFrame behaves like an inline image, it can be configured with its own scrollbar independent of the surrounding page’s scrollbar.

    A Web designer can change an IFrame’s content without requiring the user to reload the surrounding page. This capacity is enabled through JavaScript or the target attribute of an HTML anchor. Web designers use IFrames to embed interactive applications in Web pages, including those that employ Ajax (Asynchronous JavaScript and XML), like Google Maps or ecommerce applications.

    So we can eliminate the following from the onset:
    A.Buffer overflow- Manipulating an HTML iframe is not a form of buffer overflow.
    B.MITM – Once the iframe is manipulated, there is no need for a man to be in the middle
    D.SQLi – An Iframe uses Java Scripts, and not SQLi

    So the only possible answer is .”C.XSS”
    Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.
    In 2008 for example, hackers seeded Internet search results with malicious IFrame code, leading to IFrame overlay attacks on many prominent websites, including those for USA Today and ABC News. The attackers inserted IFrame code into the saved search results of legitimate websites. When a visitor clicked on a link from the compromised search tool, he would be redirected to a malicious website by the IFrame code. The unsuspecting user’s computer would then be vulnerable to the automatic download of malware.




    9



    0

Leave a Reply