Multiple choice technology security

Which attack(s) are possible in the below code: <% response.sendRedirect("/with_lang.jsp?lang="+request.getParameter("language")); %>

  1. Content Spoofing

  2. HTTP Response Splitting

  3. Directory Listing

  4. Option 1 AND Option 2

  5. Option 2 AND Option 3
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Unvalidated user input in a redirect allows Content Spoofing by manipulating the redirect location to arbitrary URLs, and HTTP Response Splitting by injecting CRLF characters (%0d%0a) to craft arbitrary response headers or body content.

Keep practicing — related questions