A university capture of a clear HTTP request contains a script tag in the request URI, while the host addresses look like ordinary campus machines. Which element carries the attack text?
Select an answer to reveal the explanation.
Short Explanation
The nasty sentence is in the letter, not printed on the envelope. You find the attack text in the clear HTTP payload. The trap is inspecting the source MAC, the TCP window, or the IP version.
Full Explanation
The right selection is "The clear HTTP payload, where the request URI carries the visible script tag that is the attack text". The script tag sits in the HTTP request line, and that HTTP message is the payload above TCP. Addresses only name the machines, so they do not hold the tag. Header fields steer and name the packet, while the attack string lives in the HTTP message those headers carry. The statement "The source MAC address in the Ethernet header, a hardware field with no script text in it" is a layer-2 hardware address and cannot contain the URI text. The statement "The TCP window size, a flow-control field carried on these packets beside the HTTP request" is a flow-control value and does not carry application text. The statement "The IP version field, a small header marker for IPv4 or IPv6 with no script text in it" only says whether the packet is IPv4 or IPv6. Exam caveat: the URI is part of the request line, so it is still in the payload when the HTTP body is empty. Operational check: reassemble the TCP stream and read the request line for the script tag instead of reading Ethernet or IP header fields.