At an agency, a reviewer treats a script that runs in the victim browser as if it were a statement that runs in the database. What is the correction?
Select an answer to reveal the explanation.
Short Explanation
A scene in the audience's seat is not a line written in the ledger. You separate a script that runs in the victim browser from a statement that runs in the database. The trap is calling them the same attack, calling both denial of service, or requiring a stolen certificate for both.
Full Explanation
Cross-site scripting is untrusted content executed by the victim browser, typically in the origin of a site the victim is using. SQL injection is untrusted input interpreted as part of a database statement. A reviewer who treats the browser script as a database statement has mixed those sinks. The correction is this: Script execution in the victim browser is cross-site scripting, and a database statement is SQL injection. One collapse of the two techniques is this: The browser script and the database statement are the same attack described under two different names in the writeup. The browser and the database are not the same place of execution. A shared-purpose reading is this: The browser script and the database statement are both techniques whose purpose is denial of service. Neither technique is defined that way, and the distinction is where the string executes. A certificate reading is this: The browser script and the database statement each require a stolen certificate before they succeed. Neither technique requires a stolen certificate in order to be what it is. On the exam, one application can be exposed to both attacks, and that still does not make a browser script into a database statement. In operations, ask where the untrusted string is interpreted, in the browser or in the query, before you name the finding.