Multiple choice technology security

AppScan sent the following test HTTP request: GET /web/content/index.php?file=/../../../../../../../../etc/passwd%00 HTTP/1.0 Cookie: JSESSIONID=dqt0LSnfhdVyTJkCwTwfLQQSkTTGYX9D79tLLpT1yLQjVhSpZKP9!914376523; customerLanguage=en Accept: / Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: www.ibm.com Although, there is no indication in the response about the existence of a password file, AppScan reported vulnerability with the following reasoning: Global Validation found an embedded script in the response (alert(25053)), which was probably injected by a previous test. The presence of this script in the site suggests that the application is vulnerable to which type of attack?

  1. Stored Cross-site Scripting

  2. Cross-site Scripting

  3. Namazu Path Traversal

  4. Directory Listing
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

The embedded script (alert(25053)) appeared in responses without being injected by the current request, indicating it was stored by the application and returned to users. This is Stored XSS (A) where malicious script persists on the server. Regular XSS (B) is reflected immediately. The path traversal attempt failed, and directory listing (D) is unrelated to script injection.

AI explanation

The injected `` tag showing up in a later response — even though the original request that planted it produced no visible reaction — indicates the payload was persisted somewhere (e.g., a database or log) and then rendered back to a different request/user later, which is the definition of Stored (persistent) Cross-site Scripting, as opposed to reflected XSS, a path traversal issue, or directory listing.

Keep practicing — related questions