Câu 215: 312-50V13: Certified Ethical Hacker v13
An ethical hacker is testing a web application of a financial firm. During the test, a 'Contact Us' form's input field is found to lack proper user input validation, indicating a potential Cross-Site Scripting (XSS) vulnerability. However, the application has a stringent Content Security Policy (CSP) disallowing inlin…
Nội dung câu hỏi
An ethical hacker is testing a web application of a financial firm. During the test, a 'Contact Us' form's input field is found to lack proper user input validation, indicating a potential Cross-Site Scripting (XSS) vulnerability. However, the application has a stringent Content Security Policy (CSP) disallowing inline scripts and scripts from external domains but permitting scripts from its own domain. What would be the hacker's next step to confirm the XSS vulnerability?
Các lựa chọn
Đáp án được giữ gọn theo nhãn A, B, C, D trong phần bình chọn tương tác.
- A. Utilize a script hosted on the application's domain to test the form — đáp án hiện tại
- B. Try to disable the CSP to bypass script restrictions
- C. Inject a benign script inline to the form to see if it executes
- D. Load a script from an external domain to test the vulnerability
Cộng đồng
0 bình luận công khai. Tên thành viên được ẩn một phần.