Question
The security team reviews a web server for XSS and runs the following Nmap scan:
```
#nmap -p80 --script http-unsafe-output-escaping 172.31.15.2
PORT STATE SERVICE REASON
80/tcp open http syn-ack
| http-unsafe-output-escaping:
|_ Characters [> " '] reflected in parameter id at http://172.31.15.2/1.php?id=2
```
Which of the following most accurately describes the result of the scan?
- A. An output of characters > and " as the parameters used in the attempt
- B. The vulnerable parameter ID http://172.31.15.2/1.php?id=2 and unfiltered characters returned
- C. The vulnerable parameter and unfiltered or encoded characters passed > and " as unsafe
- D. The vulnerable parameter and characters > and " with a reflected XSS attempt Correct
Explanation
The http-unsafe-output-escaping script finds parameters whose values are reflected in the page, submits a test string containing special characters and reports which characters come back without HTML escaping. The output names the vulnerable parameter (id on 1.php) and the characters > and " that were reflected unescaped, which is a reflected XSS test. The characters are not the parameters themselves, the URL is not the parameter ID, and the characters were reflected unencoded rather than encoded.
