問77
頻出度★★★
クロスサイトスクリプティングとは, Web サイトの脆弱性を利用した攻撃である。 クロスサイトスクリプティングに関する記述として, 適切なものはどれか。
平成24年度 春期 ITパスポート試験 問77
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 77
- ア
正解 The correct answer is ア. Cross-Site Scripting (XSS) is an attack that exploits a vulnerability called “inadequate escaping on output,” in which a website outputs the character string entered by a user directly onto a web page. The attacker slips a malicious script containing a script tag into places such as a bulletin board post field, a search form, or a confirmation screen. That script reaches the victim's browser as part of the HTML generated by the site, and it runs on the victim's browser as “a script of that site.” As a result, the cookies issued for that same site (including the session ID and the like) are sent to the attacker's server, leading to impersonation and to theft of personal information. Choice ア accurately states both the condition under which it occurs — “when a web page has a form or process that displays the user's input data as is” — and the form of the damage — “a third party embeds a malicious script to steal data such as cookies.” Note that the party harmed is mainly the site's users (viewers), and the countermeasures are validating input values and escaping that neutralizes HTML special characters on output.
Incorrectイ
This describes session hijacking, not XSS itself. It refers to an attack in which the attacker breaks into an already established legitimate session between the server and the client, guesses or steals the session ID, and impersonates a legitimate user. It is wrong because it does not include the essential mechanism of XSS: embedding a script in a web page and having it run in the viewer's browser. XSS can serve as a “means” of stealing a session ID, but the two are separate categories of attack.
Incorrectウ
This describes SQL injection. It is an attack in which a malicious SQL statement is injected into the input field of a web page that is linked to a database, tampering with the SQL that the application assembles, so as to illegitimately read from and write to the database on the server. It differs from XSS in that what is embedded is not a script but an SQL command, and the place where it is executed is not the viewer's browser but the database on the server side.
Incorrectエ
This describes phishing. It is an attack in which users are lured by email or similar means to a fake website that closely resembles the genuine one and are made to enter their own ID and password or credit card number, which is thereby defrauded from them. Rather than exploiting a vulnerability in the legitimate site, it centers on a “deception” technique that induces a misunderstanding on the user's part, and it lacks the element of embedding a malicious script, so it does not qualify as XSS.
ここがポイント
- Definition of Cross-Site Scripting (XSS): an attack that exploits a website vulnerability in which input values are output as is, causing a malicious script to run in the viewer's browser and stealing data such as cookies. The countermeasures are validating input values and escaping (sanitizing) on output.
- Distinguishing similar web attacks: XSS (embeds a script that runs in the viewer's browser), SQL injection (injects an SQL statement to illegitimately operate the server's database), session hijacking (takes over a legitimate session in order to impersonate someone), and phishing (lures users to a fake site to defraud them of information) are told apart by what is embedded, where it is executed, and who suffers the damage.
用語