Information Security

Cross-Site Scripting (XSS) attacks inject malicious scripts into trusted websites, which are then executed in the victim's browser. Therefore, the primary direct target of an XSS attack is the end user rather than the server or application framework.

CSRF (Cross-Site Request Forgery) requires three key conditions: the attacker must know the target website, the victim must be authenticated to that site, and the victim must be tricked into executing an unwanted action. CSRF does NOT require XSS vulnerability - it exploits the browser's automatic cookie submission mechanism. Options A, B, and C correctly describe these prerequisites, though they contain grammatical errors.

CSRF attacks are known by multiple names in security literature: 'Sea Surf' (play on CSRF), 'Session Riding' (because the attacker rides the victim's valid session), 'Hostile Linking' (malicious links that exploit authentication), and 'One-Click attack' (can be triggered with a single click). All four names refer to the same vulnerability.

Accepting only POST requests is not effective CSRF prevention because CSRF can trigger POST requests via HTML forms. Secret cookies alone don't prevent CSRF because the browser automatically sends cookies with requests. Effective CSRF prevention requires Anti-CSRF tokens (unique, unpredictable, validated by server) or SameSite cookie attributes (restrict cookie cross-site behavior).

The Cheese Worm was an internet worm that specifically targeted Linux systems in 2001. It exploited vulnerabilities in Linux services and was named for its unusual behavior of leaving a 'cheese' marker file. Option B is correct. Blaster worm targeted Windows, Nachi/Welchia was a Windows worm that tried to patch Blaster, and Butter worm is fictional.

Looksky, Klez, and Sober are all well-known email worms that propagate through infected email attachments or mass-mailing techniques. Warhol worm was a theoretical worm design concept focused on rapid propagation using a scanning strategy, not email-based distribution.

Samy worm and Bom Sabado are both XSS (Cross-Site Scripting) worms that spread through web applications by injecting malicious JavaScript. Samy worm targeted MySpace, while Bom Sabado affected Orkut. SQL Slammer is a SQL worm targeting database servers, and Sober is an email worm.

The principle of least privilege means granting only the minimum necessary permissions to users. Defining all allowable actions for each role and denying everything else (deny-by-default) implements this principle correctly. Group-based access (A) is an implementation detail, not the principle itself. Consistent authorization checks (B) is important for security but doesn't define least privilege. Logging failed attempts (D) is an auditing practice, not authorization.

Cross-Site Scripting (XSS) attacks specifically target the client's browser by injecting malicious scripts that execute in the victim's browser context. The attack doesn't directly target the database (B), the web application server-side (C), or the web server infrastructure (D) - those are vulnerable to different types of attacks like SQL injection or server-side code execution.

The Secure cookie flag ensures cookies are only transmitted over encrypted HTTPS connections, preventing them from being sent over insecure HTTP channels. The Domain flag (B) specifies which domains can receive the cookie. The Expires flag (C) sets cookie lifetime. 'Static' (D) is not a valid cookie attribute - this appears to be a distractor.

The primary risk of XSS is compromise of users - their sessions are hijacked, credentials stolen, or they're redirected to phishing sites. The web application's data integrity (B) isn't directly threatened by XSS. Data destruction (C) requires different vulnerabilities like SQL injection or authentication bypass. 'None of the above' would incorrectly minimize XSS severity.

ALL user-supplied input requires validation. Host Headers (A) can be used for cache poisoning or injection attacks. Cookies (B) contain user data that attackers can manipulate. Referrer Headers (C) can contain malicious URLs or scripts. Therefore 'None of the above' (D) is correct - there is no user input that can be safely trusted without validation.

Cross-Site Scripting is a vulnerability that affects any web application technology, not specific languages. Java, ASP.NET, Perl, PHP, Python, Ruby, and JavaScript-based frameworks can all be vulnerable if they improperly handle user input and render it without proper sanitization. The vulnerability is in how the application processes output, not the language itself.

White list validation means checking input against a list of known valid values and rejecting anything else (deny-by-default). Black list validation (B) checks against known bad values but allows everything else, which is less secure. White listing is the secure approach because it's a closed set - anything not explicitly permitted is rejected.

Cross-Site Scripting involves injecting malicious code into links or content from an apparently trustworthy source, exploiting the user's trust. Buffer overflows (B) are memory corruption vulnerabilities. Command injection (C) executes system commands directly. Path traversal (D) accesses files outside the web root. Only XSS involves the deceptive link characteristic.