During a penetration test, a tester finds that the web application being analyzed is vulnerable to Cross Site Scripting (XSS). Which of the following conditions must be met to exploit this vulnerability?
A.
The web application does not have the secure flag set.
B.
The session cookies do not have the HttpOnly flag set.
C.
The victim user should not have an endpoint security solution.
D.
The victim's browser must have ActiveX technology enabled. B
HTTP Only flag je varnostni ukrep, ki preprečuje dostop do piškotkov s strani skriptov na strani odjemalca (npr. JavaScripta). Piškotki so majhne datoteke, ki jih spletni strežniki pošljejo brskalniku uporabnika, in se nato shranijo na uporabnikovem računalniku.
The Secure flag is used to declare that the cookie may only be transmitted using a secure connection (SSL/HTTPS). If this cookie is set, the browser will never send the cookie if the connection is HTTP. This flag prevents cookie theft via man-in-the-middle attacks.
Note that this flag can only be set during an HTTPS connection. If it is set during an HTTP connection, the browser ignores it.
Cross-site scripting (XSS) attacks are often aimed at stealing session cookies. In such an attack, the cookie value is accessed by a client-side script using JavaScript (document.cookie). However, in everyday use, web applications rarely need to access cookies via JavaScript. Therefore, a method of protecting cookies from such theft was devised: a flag that tells the web browser that the cookie can only be accessed through HTTP – the HttpOnly flag.
Answer must be
The session cookies do not have the HttpOnly flag set.
upvoted 2 times
...
This section is not available anymore. Please use the main Exam Page.312-50 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
thinkinconcept
6 months, 2 weeks agoNovmejst
7 months, 2 weeks agosalei
1 year agoWZ1122
1 year, 8 months agoWZ1122
1 year, 8 months agoMarvelous
3 years, 1 month agoKarzee
3 years, 2 months agobrider
3 years, 7 months agosardarji2u
3 years, 11 months ago