SQL injection vs cross-site scripting (XSS): Security+ explained

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

1. Which of the following attacks occurs when text entered in a web form is built into a database command, so the database runs the text as part of the command?

   Right. In the game that’s Renown for your Threats, Vulnerabilities, and Attacks building.

   Not that one: A is right. In the game your Threats, Vulnerabilities, and Attacks building would lose a little Renown, and this question would come back later.

   The answerA.InjectionCWE-89 describes SQL injection: the product constructs all or part of an SQL command using externally influenced input without neutralizing special elements, so the input is interpreted as part of the command. That is an injection attack.Your answerB.Directory traversalDirectory traversal uses sequences such as ../ to reach files outside an allowed folder. It targets file paths, not database commands.Your answerC.Buffer overflowA buffer overflow overfills a memory buffer to corrupt adjacent data or code. Getting a database to run form input as a command is injection.Your answerD.ForgeryRequest forgery makes a user's browser or a server send a request the victim did not intend. It does not smuggle input into a database command.

   Written from cwe.mitre.org/data/definitions/89.html

2. An attacker posts a forum comment containing a script. The site saves the comment and serves it unchanged, so the script runs in every visitor's browser. Which of the following application attacks does this describe?

   Right. In the game that’s Renown for your Threats, Vulnerabilities, and Attacks building.

   Not that one: D is right. In the game your Threats, Vulnerabilities, and Attacks building would lose a little Renown, and this question would come back later.

   Your answerA.ForgeryForgery, such as cross-site request forgery, makes a logged-in victim's browser send a request it did not mean to. Here the attacker's script is placed into the page every visitor loads.Your answerB.Directory traversalDirectory traversal uses path sequences to read files outside an allowed folder. This attack adds content to a web page.Your answerC.ReplayA replay attack resends captured valid traffic, such as an authentication message. Nothing is captured here.The answerD.InjectionCWE-79 (cross-site scripting) is a child of CWE-74, Injection. It describes stored XSS as a server-side application storing dangerous data, such as in a message forum, and later reading it back into dynamic content.

   Show the full explanation and doc quotes

   The forum serving the attacker's script to visitors is an injection attack.

   Written from cwe.mitre.org/data/definitions/79.html

3. A web page passes a user-supplied hostname to the server's ping command. Entering a semicolon followed by another command makes the server run that command too. Which of the following attacks does this describe?

   Right. In the game that’s Renown for your Threats, Vulnerabilities, and Attacks building.

   Not that one: D is right. In the game your Threats, Vulnerabilities, and Attacks building would lose a little Renown, and this question would come back later.

   Your answerA.ForgeryForgery attacks make a victim's browser or a server send a request the attacker chose. Here the attacker's input changes the operating system command the server runs.Your answerB.Buffer overflowA buffer overflow puts more data into a memory area than it can hold. The attack here needs only a semicolon and a short command.Your answerC.Directory traversalDirectory traversal uses sequences such as ../ to read files outside an allowed folder. This input adds a second command instead.The answerD.InjectionCWE-78 (OS command injection) describes a product that constructs an OS command using externally influenced input but does not neutralize special elements that could modify the intended command. The semicolon is such an element, so this is an injection attack.

   Written from cwe.mitre.org/data/definitions/78.html