Which vulnerability involves injecting malicious scripts into trusted websites, with types Reflected, Stored, and DOM-based, mitigated by output encoding and Content Security Policy?

• A. SQL Injection
• B. Cross Site Scripting (XSS) Attacks
• C. Cross-Site Request Forgery
• D. Path Traversal

Answer: (B)

Cross-Site Scripting (XSS) is a vulnerability where attackers inject malicious scripts into pages that other users view, turning trusted websites into vectors for executing attacker code in a victim’s browser. It comes in three flavors: Reflected XSS, where the malicious input from a request is reflected in the immediate response; Stored XSS, where the payload is saved on the server (for example, in a database) and served to users; and DOM-based XSS, which arises from client-side code that reads data from the page’s DOM and uses it to modify the page, enabling script execution without server-side changes. Mitigations include output encoding, which neutralizes potentially dangerous characters so injected scripts aren’t executed, and a Content Security Policy that restricts where scripts can be loaded from and what they can do, reducing the impact of any injected payloads.

Other vulnerabilities mentioned don’t involve injecting scripts into trusted websites. SQL Injection targets databases by injecting malicious SQL into queries; Cross-Site Request Forgery tricks a user’s browser into performing actions they didn’t intend; Path Traversal attempts to access files outside the web root by manipulating file paths.