Question
During a web application assessment, a penetration tester identifies an input field that allows JavaScript injection. The tester inserts a line of JavaScript that results in a prompt, presenting a text box when browsing to the page going forward. Which of the following types of attacks is this an example of?
- A. SQL injection
- B. SSRF
- C. XSS Correct
- D. Server-side template injection
Explanation
Injecting JavaScript that the page stores and runs for every later visitor is cross-site scripting (XSS), here a stored XSS because the prompt appears whenever the page is browsed. SQL injection targets database queries, SSRF makes the server send requests to other systems, and server-side template injection runs code inside the server's template engine rather than in the victim's browser.
