Which of the following attack types BEST describes a client-side attack that is used to manipulate an HTML iframe with JavaScript code via a web browser?
A.
Buffer overflow
B.
MITM
C.
XSS
D.
SQLi
Get 50% Discount on All Your Purchases
at PrepAway.com - Latest Exam Questions
This is ONE TIME OFFER
50%
The questions give us a number of clues
We are talking about:
1) A client-side attack that is used to manipulate an HTML iframe
2) Using JavaScript
An IFrame (Inline Frame) is an HTML document embedded inside another HTML document on a website. The IFrame HTML element is often used to insert content from another source, such as an advertisement, into a Web page. Although an IFrame behaves like an inline image, it can be configured with its own scrollbar independent of the surrounding page’s scrollbar.
A Web designer can change an IFrame’s content without requiring the user to reload the surrounding page. This capacity is enabled through JavaScript or the target attribute of an HTML anchor. Web designers use IFrames to embed interactive applications in Web pages, including those that employ Ajax (Asynchronous JavaScript and XML), like Google Maps or ecommerce applications.
So we can eliminate the following from the onset:
A.Buffer overflow- Manipulating an HTML iframe is not a form of buffer overflow.
B.MITM – Once the iframe is manipulated, there is no need for a man to be in the middle
D.SQLi – An Iframe uses Java Scripts, and not SQLi
So the only possible answer is .”C.XSS”
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.
In 2008 for example, hackers seeded Internet search results with malicious IFrame code, leading to IFrame overlay attacks on many prominent websites, including those for USA Today and ABC News. The attackers inserted IFrame code into the saved search results of legitimate websites. When a visitor clicked on a link from the compromised search tool, he would be redirected to a malicious website by the IFrame code. The unsuspecting user’s computer would then be vulnerable to the automatic download of malware.
9
0