CompTIA PenTest+ Practice Test

What type of attack involves injecting JavaScript that executes on the client's browser?

1. Cross-site scripting (XSS) attack

2. Persistent XSS attack

3. Reflected XSS attack

4. DOM-based XSS attack

The correct answer is: Cross-site scripting (XSS) attack

The correct answer identifies Cross-Site Scripting (XSS) as a type of attack that involves injecting JavaScript into a web application, resulting in the script executing within the client's browser. This is a significant concern in web security because it enables attackers to manipulate the content of the website as it is displayed to the user. By injecting malicious scripts, an attacker can steal session cookies, redirect users to malicious sites, or even perform actions on behalf of the user without their consent. XSS attacks exploit the trust a user has for a particular site. When the client’s browser processes the JavaScript, it may execute unintended actions, leading to potential data breaches or compromises. This technique highlights the importance of validating and sanitizing user input on web applications to prevent become vulnerable to such attacks. The other forms of XSS mentioned, such as Persistent, Reflected, and DOM-based XSS, are all specific variants of the broader XSS attack. Persistent XSS involves injecting a script that is stored on the server and served to users over time. Reflected XSS occurs when the injected script is reflected off a web server, typically via URL parameters, posing a risk when users are tricked into clicking a crafted link. DOM-based XSS is primarily