Exam FCP_FWB_AD-7.4 Topic 3 Question 83 Discussion

Cross-Site Scripting (XSS) is a type of web security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. This can lead to session hijacking, credential theft, or redirection to malicious sites. XSS attacks typically exploit vulnerabilities in web applications that fail to properly sanitize user input.
Here's an analysis of the given options:
A . SELECT username FROM accounts WHERE username='admin';-- ' AND password='password'; This is an example of SQL Injection (SQLi) rather than XSS. It manipulates SQL queries to bypass authentication, not execute JavaScript in a user's browser.
B . <img src="http://badfile/nothere" onerror=alert(document.cookie);>
This is a classic XSS attack.
It uses an <img> tag with a non-existent src attribute.
The onerror event triggers when the image fails to load, executing alert(document.cookie);, which can expose session cookies.
This method is commonly used for stealing cookies or executing arbitrary scripts.
C . SELECT username FROM accounts WHERE username='XSS' ' AND password='alert("http://badurl.com")'; This is neither a valid SQL injection nor a valid XSS attack.
The syntax suggests an incorrect SQL query rather than JavaScript execution in a browser.
D . <IMG SRC="xss.png">
This is not a valid XSS attack unless there is an additional event handler like onload, onerror, or onmouseover executing JavaScript.
By itself, it just loads an image and does not execute any malicious script.
Thus, Option B is the correct answer as it represents a real-world XSS attack technique.
Reference:
OWASP XSS Guide: https://owasp.org/www-community/attacks/xss/
Fortinet XSS Protection Documentation: https://docs.fortinet.com/