` submitted through an unauthenticated feedback form. Which of the following correctly","text":"A security analyst reviewing Network Intrusion Detection System (NIDS) alerts for an enterprise web server identifies multiple HTTP POST requests containing payload strings such as `` submitted through an unauthenticated feedback form. Which of the following correctly","inLanguage":"en","acceptedAnswer":{"@type":"Answer","text":"Cross-Site Scripting (XSS), which attempts to execute malicious scripts in a client's web browser session","answerExplanation":{"@type":"Comment","text":"Cross-Site Scripting (XSS), which attempts to execute malicious scripts in a client's web browser session The alert payload contains `

A security analyst reviewing Network Intrusion Detection System (NIDS) alerts for an enterprise web server identifies multiple HTTP POST requests containing payload strings such as `<script>document.cookie</script>` submitted through an unauthenticated feedback form. Which of the following correctly identifies the type of attack detected by network monitoring?

1. Cross-Site Scripting (XSS), which attempts to execute malicious scripts in a client's web browser sessionAnswer
2. B
   SQL Injection (SQLi), which attempts to manipulate backend database queries through unvalidated form inputs
3. C
   Buffer Overflow, which attempts to overwrite system memory registers on the web server host
4. D
   Honeypot redirection, which automatically filters and traps malicious web traffic into an inline isolation sandbox

Answer

Cross-Site Scripting (XSS), which attempts to execute malicious scripts in a client's web browser session

The alert payload contains `<script>` tags and JavaScript properties (`document.cookie`), which are classic indicators of a Cross-Site Scripting (XSS) attack. XSS targets client browsers that render untrusted user input without sanitization.

Step-by-Step Solution

1

Analyze the log payload in the NIDS alert

Identified HTML/JavaScript tags `<script>document.cookie</script>` in HTTP POST request parameters

Determining the target execution environment (client-side browser vs backend database or operating system) is essential for accurate alert triage

2

Classify the attack vector based on payload syntax

Script tag insertion targeting session cookies indicates a Cross-Site Scripting (XSS) attempt

XSS vulnerabilities allow attackers to inject client-side scripts to compromise user sessions when rendered by the web browser

Key Concept

Identifying web application attack signatures in Network Security Monitoring (NSM) alerts

Common Mistakes