Information Security

Cross Site Scripting (XSS) specifically targets the browser's interpreter - it exploits how browsers interpret and execute scripts within web pages. Unlike attacks that target servers (B, C) or file systems (A), XSS payloads run in the victim's browser context. The term 'Browser Interpretation' (D) correctly identifies this client-side execution environment.

This scenario is a classic example of Broken Authentication and Session Management - the user failed to properly terminate their session (logout), allowing an attacker to hijack the authenticated session. The vulnerability is that session identifiers remained valid and accessible, enabling the attacker to impersonate the legitimate user without re-authenticating. This differs from authorization issues (A), security misconfiguration (C), or CSRF (D).

Exposing session IDs or authentication credentials in URLs (B) is a valid scenario of Broken Authentication and Session Management. URLs get logged in browser history, server logs, and referrer headers - exposing sensitive authentication data in URLs allows attackers to capture session identifiers. Option (A) describes an authorization issue, (C) is about data exposure, and (B) is the correct authentication/session management vulnerability.

Using per-user or session indirect object references (like using database IDs instead of sequential numbers) prevents Insecure Direct Object References. Without this, attackers can manipulate URLs or parameters to access other users' data by guessing or incrementing IDs. This ensures users can only access objects they're authorized to see.

Cross Site Request Forgery (CSRF) involves attackers forging authenticated requests that victims unknowingly submit. Since the browser automatically sends cookies (including session tokens) with the request, the server believes it's from the legitimate user. Key indicators: forged requests, tricking victims, authentication bypass. Unlike XSS which executes scripts in the browser.

CSRF tokens are unique, unpredictable values included in forms as hidden fields. When the form is submitted, the server validates this token matches the session token. Since attackers cannot guess or obtain this token, they cannot forge valid requests even if they trick users into submitting forms. This is the primary defense against CSRF.

Exception stack traces exposed to users reveal internal system details: file paths, database schemas, software versions, and potential vulnerabilities. Attackers use this information for targeted attacks. This is a clear case of Security Misconfiguration (specifically, Weak Security Configuration). Proper error handling should show generic messages to users.

Using strong hashing algorithms with salts prevents Insecure Cryptographic Storage. Salting adds uniqueness to each password, preventing rainbow table attacks. Strong hashing (bcrypt, scrypt, Argon2) resists brute-force attacks. Without these, stolen password databases can be easily cracked, leading to credential theft.

This is a classic Insecure Cryptographic Storage scenario. Encrypting data is useless if the decryption key is stored alongside the encrypted data. When the backup tape is stolen, the attacker has both the encrypted data and the key to decrypt it. Keys must be stored separately, preferably in a secure key management system.

Failure to Restrict URL Access happens when applications don't verify authorization for every page request. Attackers can simply guess or manipulate URLs (like /admin, /user/profile/123) to access privileged functionality. The scenario describes this exactly - an authorized user changes URL to access unprotected privileged pages.

The deny-by-default approach prevents Failure to Restrict URL Access by ensuring no page is accessible without explicit authorization. This is a defense-in-depth strategy where developers must explicitly grant access rather than accidentally leave pages unprotected. It prevents attackers from accessing unprotected pages through URL manipulation.

Not using SSL for authenticated pages allows attackers on the network to intercept session cookies (sniffing). Requiring SSL for all sensitive pages encrypts traffic, preventing cookie theft. The scenario describes Insufficient Transport Layer Protection. Requiring SSL and redirecting non-SSL requests is the correct defense.

Spyware is specifically designed to secretly collect personal information, including passwords, financial details, and browsing habits. This makes it the most dangerous type for identity theft. Worms replicate themselves, adware displays ads, and Trojans disguise themselves as legitimate software, but spyware's primary purpose is data theft.