問84
頻出度★★★
クロスサイトスクリプティングに関する記述として, 適切なものはどれか。
平成27年度 春期 ITパスポート試験 問84
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 84
- ア
正解 Cross-site scripting (XSS) is an attack that exploits a vulnerability in sites, such as message boards and search forms, that output user input directly onto a web page. When an attacker slips a script (for example, a script tag) into the input data, a script not intended by the site operator gets mixed into the output, is sent to the viewer's browser, and is executed there. As a result, damage such as theft of cookies (session IDs) or the display of fake input forms occurs. A characteristic point is that the damage falls not on the server but on the browser of the user who viewed the page, and ア states this, so it is the correct answer. The countermeasures are validating input values and escaping (sanitizing) at the time of output.
Incorrectイ
Embedding operating system (OS) commands into input fields, sending them to the web server, and having the server execute them so as to manipulate it illegitimately is a description of OS command injection. What is targeted is the web server (its OS) itself, so it is a different attack from XSS, which makes a script run in the user's browser.
Incorrectウ
Abusing the habit of reusing the same ID and password across multiple sites and attempting to log in to other sites with credentials leaked somewhere is a description of a password list attack (list-type attack), and it has nothing to do with embedding scripts.
Incorrectエ
Making a malicious program look like useful software so that it is installed and intrudes into the user's computer is a description of a Trojan horse. It is a technique that gets users themselves to install malware, and it differs from XSS, which exploits a vulnerability in web page output.
ここがポイント
- Cross-site scripting is an attack that exploits a vulnerability in websites that output user input as is, sending a script not intended by the operator into the viewer's browser and having it executed. The countermeasures are validating input values and escaping (sanitizing) at the time of output.
- Distinguishing similar attack techniques: OS command injection = illegitimately executing OS commands on the web server; password list attack = abusing the reuse of IDs and passwords; Trojan horse = malware disguised as useful software.
用語