Ethical Hacking Essentials Practice Test

What security risk was identified by a pen tester who found untrusted data and a lack of validation or escaping in an application?

1. Cross-Site Request Forgery

2. Cross-Site Scripting (XSS)

3. Broken Authentication

4. Injection Attacks

The correct answer is: Cross-Site Scripting (XSS)

The identified security risk relates directly to Cross-Site Scripting (XSS) because XSS vulnerabilities arise when an application accepts untrusted data without proper validation or escaping. When user input is not adequately sanitized, it enables attackers to inject malicious scripts that can be executed in the browsers of other users who access the vulnerable application. This can lead to various harmful consequences, such as session hijacking, redirection to malicious sites, or data theft. XSS is particularly concerning in web applications that display user-generated content, as the lack of validation allows for the introduction of scripts that can manipulate how content is presented or interact with the users. The essence of this vulnerability is rooted in the application's failure to differentiate between trusted and untrusted data and not employing necessary precautions to neutralize potential threats from input data. Therefore, the presence of untrusted data and the absence of proper validation mechanisms directly point to the risk of XSS.