Multiple choice technology security

George obtains code that steals user session keys. He is able to post the code on a compromised website where Alice has an account. When she accesses the site he session key is sent to George? What type of attack is this ?

  1. SQL Injection

  2. Cross site scripting (XSS)

  3. Buffer Overflow

  4. None of the choices
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

This is Cross Site Scripting (XSS). George posts malicious code (script) on a website, and when Alice visits it, her browser executes the code, sending her session key to George. This is the classic XSS attack pattern: inject script, victim visits, script executes in victim's browser context. SQL Injection (A) targets databases, not client-side session theft. Buffer Overflow (C) is a memory corruption vulnerability.

AI explanation

This is Cross-Site Scripting (XSS): an attacker injects malicious script into a trusted website (often via stored/persistent input), and when another user's browser loads and executes that page, the script runs in the victim's authenticated session context and can exfiltrate data like session cookies/keys back to the attacker. SQL injection targets a database backend and buffer overflow is a memory-corruption issue, neither of which matches this client-side script-execution scenario.

Keep practicing — related questions