Exam 350-701 topic 1 question 7 discussion

Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website, instant message, or simply just reading a web board or email message. Usually the attacker will encode the malicious portion of the link to the site in HEX (or other encoding methods) so the request is less suspicious looking to the user when clicked on. For example the code below is written in hex: <a href=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>Click Here</a> is equivalent to: <a href=javascript:alert('XSS')>Click Here</a> Note: In the format “&#xhhhh“, hhhh is the code point in hexadecimal form

C. cross-site scripting Cross-site scripting (XSS) is a type of security vulnerability typically found in web applications, that allows an attacker to inject malicious code into a web page viewed by other users. One of the methods attackers use to evade detection and make the injected code more difficult to detect is by using alternate encoding, such as hexadecimal representation. This makes the code harder to read and understand, making it more difficult to detect and remove. This technique is often used in XSS attacks as it allows attackers to hide the malicious code and evade detection by security software and systems.

Cross-Site Scripting (XSS) is the attack where alternate encoding, such as hexadecimal or URL encoding, is most commonly observed.

Ans: C

It's C

It could be C but why not D?

not sure about the correct answer for this Q

There are some common characters sets that are used in Web applications attacks. For example, Path Traversal attacks use ../ (dot-dot-slash) , while XSS attacks use < and > characters. These characters give a hexadecimal representation that differs from normal data. https://owasp.org/www-community/Double_Encoding

Would somebody be able to explain why the answer is Cross Side Scripting please?