GIAC Foundational Cybersecurity Technologies Practice Test

What type of vulnerability is illustrated where there is code in the web page?

1. File Inclusion

2. Clickjacking

3. Cross-Site Scripting

4. SQL injection

The correct answer is: File Inclusion

The correct answer is Cross-Site Scripting, which is a type of vulnerability that allows an attacker to inject malicious scripts into web pages viewed by other users. This occurs when a web application includes untrusted data without proper validation or escaping. As a result, users who visit a web page that has been exploited may inadvertently execute the malicious code, leading to a range of harmful effects, such as session hijacking, data theft, or defacement of the website. In this context, the presence of code within the web page suggests that there is a potential opportunity for an attacker to execute scripts in the context of another user's session. Consequently, this highlights the importance of implementing security measures such as input validation and output encoding to prevent such vulnerabilities. Given the discussion, while other options like file inclusion, clickjacking, and SQL injection are also significant threats, they represent different types of vulnerabilities that do not focus primarily on the execution of code in a web page context by a user. The nature of Cross-Site Scripting makes it particularly relevant in environments where user input is reflected or returned in the response without adequate sanitization.