A security administrator develops a web page and limits input into the fields on the web page as
well as filters special characters in output. The administrator is trying to prevent which of the
following attacks?

A.
Spoofing

B.
XSS

C.
Fuzzing

D.
Pharming

Explanation:
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web
applications. XSS enables attackers to inject client-side script into Web pages viewed by other
users.
Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug-in
systems on which they rely. Exploiting one of these, attackers fold malicious content into the
content being delivered from the compromised site. When the resulting combined content arrives
at the client-side web browser, it has all been delivered from the trusted source, and thus operates
under the permissions granted to that system. By finding ways of injecting malicious scripts into
web pages, an attacker can gain elevated access-privileges to sensitive page content, session
cookies, and a variety of other information maintained by the browser on behalf of the user.
By validating user input and preventing special characters, we can prevent the injection of clientside scripting code.