CCNA Web Application and Injection Attacks Questions

Username enumeration occurs when a web application's login mechanism provides distinct responses or behaviors for valid versus invalid usernames. This difference, which could manifest as varying HTTP status codes, specific error messages (e.g., "Username exists" vs. "Invalid credentials"), or even subtle timing discrepancies, allows an attacker to systematically test usernames and identify which ones correspond to existing accounts. Once valid usernames are identified, they become targets for subsequent brute-force attacks or credential stuffing.

Directory traversal, also known as path traversal, is an attack that allows an attacker to access files and directories stored outside the web root directory. The `../` sequences in the request are a clear indicator, as they instruct the server to navigate up the directory hierarchy. By repeatedly using `../`, the attacker attempts to escape the restricted web directory and access sensitive system files like `/etc/passwd`.

Cross-Site Request Forgery (CSRF) exploits a user's authenticated session to force their browser to send an unwanted request to a vulnerable web application. A common defense against CSRF involves the server inspecting the HTTP Referer header to verify that the request originated from the application's own domain, preventing requests from external, malicious sites. An analyst successfully bypassing this Referer header check by manipulating or omitting it directly demonstrates a CSRF vulnerability, as the server's origin validation mechanism has been defeated.

Burp Intruder is specifically engineered to automate custom, payload-driven attacks against web applications. Users define "payload positions" within a base request, then configure various payload sets and attack types (e.g., Sniper, Battering Ram, Pitchfork) to systematically inject values into those positions. This powerful tool is ideal for brute-forcing, fuzzing, credential stuffing, and other repetitive tasks requiring automated request modification and response analysis.

A CSRF token is a unique, unpredictable, and secret value generated by the server and included with every state-changing request, typically embedded in hidden form fields or request headers. The server validates this token upon receiving the request, ensuring it matches the token associated with the user's session. Since a malicious attacker operating from a different origin cannot obtain or guess this secret token, they cannot craft a valid forged request that the server would accept, thereby effectively preventing CSRF attacks.

Disabling unnecessary URL schemas, such as `file://`, `dict://`, `gopher://`, or `ftp://`, is a crucial mitigation for Server-Side Request Forgery (SSRF). By restricting the protocols the server can use to make outbound requests, the attack surface is significantly reduced. This prevents attackers from leveraging the vulnerability to access local files, perform port scanning, or interact with internal services using non-HTTP protocols, thereby blocking common exploitation vectors.

This statement accurately describes the core differences. Reflected XSS is non-persistent because the malicious payload is delivered via a crafted URL or form submission and is immediately reflected in the server's response, requiring the victim to click a specific link. In contrast, Stored XSS is persistent; the malicious script is permanently saved on the target server (e.g., in a database) and is then served to any user who accesses the vulnerable web page, affecting multiple users without individual interaction beyond visiting the compromised page.

XML External Entity (XXE) injection occurs when an XML parser processes a DOCTYPE declaration that defines an external entity, allowing the attacker to include content from external URIs or local files into the XML document. By defining an entity that points to a file path like `/etc/passwd`, the server's XML parser will attempt to resolve and embed the file's content within the XML response or process it internally. This vulnerability leverages the server's ability to fetch resources specified within the DTD, leading to information disclosure or even server-side request forgery.

Stored Cross-Site Scripting (XSS), also known as Persistent XSS, occurs when a malicious script is permanently saved on the target server, typically within a database, message board, or comment section. When any user subsequently accesses the affected web page, the server retrieves and delivers the stored malicious payload along with the legitimate content. This script then executes automatically in the victim's browser, impacting all users who view the compromised data without requiring any specific interaction from them beyond page access.

In-band SQL injection is SQLMap's default and preferred method because it allows the attacker to retrieve data directly through the same communication channel used for the original query. This category includes UNION-based attacks, which append a malicious SELECT statement to the original query to return additional data, and error-based attacks, which force the database to return error messages containing query results. These methods are generally the fastest and most efficient for data extraction when applicable, providing immediate feedback.

Cross-Site Request Forgery (CSRF) attacks trick authenticated users into submitting unintended requests to a web application, leveraging their existing session. CSRF tokens are unique, unpredictable, and secret values generated by the server and embedded within forms or request headers. Upon submission, the server validates the token, ensuring the request originated from the legitimate application and user, thereby preventing an attacker's forged request from being processed.

The 'Options -Indexes' directive explicitly disables the automatic generation of directory listings when a default index file (such as index.html or index.php) is not found within a directory. By removing the 'Indexes' option, the web server is configured to return a '403 Forbidden' error instead of displaying the contents of the directory to the client. This is the direct and intended method for preventing directory browsing in Apache, effectively mitigating information disclosure risks.

Remote File Inclusion (RFI) vulnerabilities allow an attacker to force the web application to include and execute or display a file hosted on a remote server, typically controlled by the attacker. This is achieved by injecting a full URL into a vulnerable parameter that the application uses to dynamically include files. The payload's explicit use of a remote URL is the defining characteristic of an RFI attack, enabling the server to fetch and process content from an external source.

Out-of-band SQLi exfiltrates data through a separate channel such as DNS or HTTP requests, used when in-band and inferential techniques are blocked. It is a recognised SQL injection category, satisfying the question's requirement for attack types.

A defining characteristic of Stored XSS, also known as Persistent XSS, is that the attacker's malicious script is successfully injected into and saved within the web application's backend infrastructure, such as a database, comment section, or user profile. This persistence means the payload remains on the server, ready to be delivered to any user who later requests the affected content, making it a highly potent and widespread threat.

Implementing a whitelist of allowed domains and IP addresses for outbound requests is the most effective defense against Server-Side Request Forgery (SSRF). This robust control ensures the server can only initiate connections to explicitly permitted external resources or internal services. By strictly restricting outbound connections to a predefined, trusted list, any attempt by an attacker to force the server to connect to unauthorized internal systems or arbitrary external hosts will be blocked, directly mitigating the SSRF vulnerability.

Correct. SSRF occurs when the server is tricked into making internal requests based on user-controlled input, such as the X-Forwarded-For header, which can lead to access to internal resources or administrative interfaces.

Prepared statements, also known as parameterized queries, are a primary defense against SQL injection because they fundamentally separate the SQL code logic from user-supplied data. The database engine pre-compiles the query structure, treating all subsequent input as literal data values rather than executable SQL commands. This mechanism ensures that malicious characters within user input cannot alter the intended query structure, effectively preventing injection attacks by ensuring input is never interpreted as code.

The presence of unexpected rows or columns in an application's query results is a strong indicator of a successful UNION-based SQL injection. Attackers leverage the `UNION` operator to combine the results of their malicious query with the legitimate query, thereby extracting data from other tables or databases that were not intended for display. This manipulation directly alters the structure and content of the returned dataset, making it a clear sign of data exfiltration or unauthorized data retrieval.

Intruder is purpose-built for automating parameterized attacks by systematically injecting various payloads into specified insertion points within an HTTP request. It enables sophisticated brute-force, dictionary, and credential stuffing attacks by iterating through user-defined lists or generated sequences of values. This module offers multiple attack types, such as Sniper or Battering Ram, to efficiently test a wide range of input fields for vulnerabilities or weak credentials.

XXE injection occurs when an XML parser processes XML input containing references to external entities, which are then resolved by the server without proper validation. Attackers can define malicious external entities within the Document Type Definition (DTD) to exploit this, often using the "file://" protocol to read local files from the server's filesystem, such as configuration files or sensitive credentials. This direct file disclosure via XML entity processing perfectly matches the described observation.

Directory traversal, also known as path traversal, is a vulnerability that permits an attacker to read arbitrary files on the server's file system by manipulating file paths in user-supplied input. This exploit uses sequences like "../" (dot-dot-slash) to navigate outside the intended directory, bypassing security controls that fail to properly validate or sanitize file names or paths. The ability to "view documents by specifying" a path directly aligns with this vulnerability, as it focuses on accessing files located anywhere on the server.

This vulnerability occurs entirely on the client-side when a web application's JavaScript code processes user-controllable data, often from the URL fragment (#) or query string (?), and writes it unsafely into the Document Object Model (DOM). If the client-side script dynamically generates HTML or JavaScript using this unvalidated input, an attacker can inject malicious code that executes within the victim's browser. The "reflection" happens within the browser's DOM, not necessarily on the server's response.

Username enumeration occurs when a web application's login mechanism provides distinct error messages or response times for valid usernames compared to invalid ones, even if the password is incorrect. For instance, "Invalid password for user 'admin'" versus "User 'admin' does not exist." This differential feedback allows an attacker to systematically test common usernames and compile a list of valid accounts, significantly aiding in subsequent brute-force or credential stuffing attacks.

The HTTP OPTIONS method is specifically designed to query a web server or resource about the communication options supported by the server for that particular URL. It provides a list of allowed HTTP methods (e.g., GET, HEAD, POST, PUT, DELETE, TRACE, CONNECT) in the 'Allow' header of its response. This is crucial for a penetration tester to discover if potentially vulnerable methods like PUT (for file upload) or WebDAV methods are enabled before attempting to exploit them.

Cross-site request forgery (CSRF) exploits the trust a web application has in an authenticated user's browser. An attacker crafts a malicious web page or email that, when visited or opened by an authenticated user, forces their browser to send an unintended request to the vulnerable application. The application, failing to verify the request's true origin or intent, processes the forged request, often relying on session cookies. Manipulating or bypassing checks on the Referer header can be a technique used in CSRF attacks, as applications sometimes use it as a weak defense to ensure requests originate from the expected domain.

Intruder is the dedicated Burp Suite tool for automating customized attacks against web applications by systematically sending multiple requests with variable payloads. It allows testers to define specific insertion points within a request and iterate through a list of payloads, making it ideal for brute-forcing credentials, fuzzing input fields, and identifying injection vulnerabilities like SQLi or XSS with high precision and control over attack types.

Reflected XSS occurs when a malicious script, supplied in an HTTP request, is immediately and unsafely echoed back in the server's HTTP response. The server takes user-supplied input, often from a URL parameter, and directly embeds it into the HTML page without adequate sanitization or encoding. This causes the victim's browser to execute the script upon receiving the crafted response, making it a non-persistent, single-request attack.

SQLMap is an open-source penetration testing tool specifically engineered to automate the process of detecting and exploiting SQL injection flaws in web applications. It supports a wide array of SQL injection techniques, including boolean-based blind, error-based, union query, stacked queries, and time-based blind, across various database management systems. Its specialized algorithms and extensive payload database make it highly efficient and effective for fully automating the identification and exploitation of SQL injection vulnerabilities.

Time-based blind SQL injection is a technique where the attacker infers information by observing the time it takes for the database server to respond to specific queries. By introducing conditional delays (e.g., IF(condition, SLEEP(5), 0)), the presence or absence of a delay indicates whether the condition is true or false. The 'T' option in sqlmap explicitly instructs the tool to employ this method, making it the correct answer.

Insecure Direct Object Reference (IDOR) occurs when an application exposes a direct reference to an internal implementation object, such as a file, directory, or database record, and fails to implement sufficient authorization checks. By manipulating parameters like 'id' in a URL or API request, an attacker can bypass authorization and access resources belonging to other users or system components. This direct manipulation of object identifiers to gain unauthorized access perfectly describes the scenario where changing an 'id' parameter reveals another user's data.

The SameSite cookie attribute directly addresses Cross-Site Request Forgery (CSRF) attacks by restricting when a browser sends cookies with cross-site requests. By setting SameSite to Lax or Strict, the browser will not attach the session cookie to requests originating from a different site, effectively preventing an attacker's forged request from being authenticated by the victim's browser. This significantly reduces the risk of unauthorized actions being performed on behalf of the user without their explicit intent.

Burp Intruder is specifically engineered for automating customized attacks against web applications, making it ideal for brute-forcing, fuzzing, and credential stuffing. It allows users to define specific insertion points within a request and then systematically iterate through custom payload lists, applying various attack types like Sniper, Battering Ram, Pitchfork, and Cluster Bomb. This precise control over payload generation and delivery makes it the tool of choice for automating targeted attack scenarios.

Stored XSS, also known as Persistent XSS, is a severe web vulnerability where a malicious script is permanently saved on the target server, typically within a database, comment section, or feedback system. When a legitimate user, such as an administrator, later retrieves and views the compromised data, their browser executes the embedded script without their knowledge. This allows the attacker to compromise user sessions, deface websites, or redirect victims, making it a highly impactful vulnerability due to its persistence and widespread potential.

Local File Inclusion (LFI) is the correct classification for this vulnerability, as it involves an attempt to include files present on the web server's local file system. However, the crucial detail preventing immediate success is the automatic appending of the ".php" extension to the user-supplied input. This means an attempt to include a file like "/etc/passwd" would result in the application trying to include "/etc/passwd.php", which typically does not exist, thereby blocking direct access to the target file without further bypass techniques.

Generic error messages, such as "Invalid username or password," are a crucial defense against username enumeration vulnerabilities. By providing the exact same response regardless of whether the submitted username is valid but the password is wrong, or if the username itself does not exist in the system, the application denies attackers the ability to differentiate between these two states. This ambiguity prevents an attacker from systematically testing a list of potential usernames to identify which ones are registered within the system.

Username enumeration is an attack where an attacker attempts to discover valid usernames by observing differences in application responses (e.g., distinct error messages, varying HTTP status codes, or even subtle timing discrepancies) when submitting valid versus invalid usernames. For instance, a "User not found" message for an invalid username compared to an "Incorrect password" message for a valid one clearly indicates a username's existence, allowing an attacker to compile a list of active accounts. This technique is a critical precursor to many other credential-based attacks.

Burp Suite Proxy is a core component of the Burp Suite platform, specifically engineered to sit between a web browser and a target web server. It functions as an intercepting HTTP/S proxy, allowing a penetration tester to view, modify, and replay individual requests and responses in real-time before they reach their destination. This capability is fundamental for identifying vulnerabilities by manipulating parameters, headers, and other traffic components.

Blind SQL injection extracts data without visible output or errors, relying on boolean true/false responses or deliberate time delays to infer database contents. This distinct technique satisfies the question's requirement for a recognised SQL injection category, alongside in-band and out-of-band variants.

The `Content-Security-Policy` (CSP) header with the `frame-ancestors` directive explicitly defines which origins are permitted to embed the current resource in a frame, iframe, object, or embed tag. By restricting framing to 'self' or specific trusted domains (e.g., `frame-ancestors 'self'`), this policy directly prevents malicious external websites from embedding the target page. This robust defense effectively mitigates clickjacking attacks by controlling the contexts in which a page can be framed, thereby preventing UI redressing.

Insecure Direct Object Reference (IDOR) vulnerabilities arise when an application exposes a direct reference to an internal implementation object, such as a file, directory, or database record, without sufficient authorization checks. By simply changing a numeric ID in the URL, the security analyst is directly accessing another object that they should not be authorized to view or modify, demonstrating a clear failure in access control for that specific resource.

Stored XSS occurs when attacker-supplied script is persisted server-side, for example in a database or comment field, and then served to every visitor viewing the affected page. That permanent server-side storage and execution on page view is the defining indicator distinguishing it from reflected XSS.

CSRF tokens are unique, unpredictable, and secret values generated by the server and embedded into forms or URLs for state-changing operations. When a user submits a request, the server verifies that the token included in the request matches the one stored in the user's session. This mechanism effectively prevents CSRF attacks because an attacker cannot forge a valid request without knowing the user's unique, session-specific token, which is not accessible to them.

Remote File Inclusion (RFI) occurs when a web application dynamically includes a file from a remote server, typically specified by a URL in user-controlled input. This vulnerability allows an attacker to inject and execute malicious code hosted on their own server within the context of the vulnerable web application. The application fetches the remote file (e.g., via HTTP) and processes its content as if it were a local script, leading to potential arbitrary code execution.

Local File Inclusion (LFI) vulnerabilities allow an attacker to read arbitrary files from the server's file system. By manipulating the vulnerable parameter with paths like /etc/passwd or /etc/shadow, an attacker can directly access and disclose critical system configuration files, user credentials, or application source code. This exposure of sensitive data is a primary and direct impact of LFI, providing valuable information for further exploitation.

The SameSite=Strict attribute is a powerful defense against CSRF attacks by instructing the browser to only send the cookie with requests originating from the same site as the cookie's domain. This means if a user is logged into `example.com` and then visits `malicious.com`, any requests `malicious.com` attempts to make back to `example.com` will not include the session cookie. Consequently, the malicious request will not be authenticated, effectively preventing the forgery.

CSRF tokens are the most effective defense against Cross-Site Request Forgery (CSRF) attacks. These unique, unpredictable, and secret values are generated server-side for each user session and embedded within critical state-changing requests, such as form submissions. The server then validates the presence and correctness of this token upon receiving the request, ensuring that the request originated from the legitimate application and not from an attacker's malicious site.

For HTTP Response Splitting to occur, user-supplied input containing CRLF sequences must be directly incorporated into an HTTP response header. This allows an attacker to terminate the current header line and inject new, arbitrary header fields or even an entirely new response body. Without this direct reflection in the headers, the injected CRLF sequences would not be interpreted as control characters for the HTTP protocol, making the attack impossible.

Object-Relational Mappers (ORMs) provide an effective defense against SQL injection by abstracting database interactions and typically generating parameterized queries. Instead of concatenating user input directly into SQL strings, ORMs bind input values as parameters, ensuring they are treated as data and not executable code. This fundamental separation prevents malicious input from altering the query's structure, thereby neutralizing injection attempts.

Time-based blind SQL injection is the appropriate technique when the application provides no direct output and no discernible boolean difference in its responses. This method relies on making the database server pause for a specific duration (e.g., using `SLEEP()`, `WAITFOR DELAY`, or `PG_SLEEP()`) if a particular injected condition is met. By measuring the time taken for the server to respond, the penetration tester can infer the truthfulness of conditions and extract data character by character.

Server-Side Request Forgery (SSRF) occurs when an attacker exploits a vulnerability in a web application to compel the server itself to make arbitrary requests. These requests can target internal network resources, such as other services, databases, or cloud metadata APIs, which are typically inaccessible directly from the internet. The server acts as a proxy, fetching data or performing actions on behalf of the attacker, often bypassing firewall rules and network segmentation. This allows for reconnaissance, port scanning, and even direct interaction with sensitive internal systems.

The `--dbs` option explicitly instructs sqlmap to enumerate and display the names of all accessible databases on the target system by querying the database's information schema or system tables. Concurrently, the `--batch` option ensures that sqlmap operates in a non-interactive mode, automatically accepting default choices and proceeding without requiring user input for any prompts or questions that might arise during the enumeration process. This combination efficiently retrieves database names without interruption, which is ideal for automated scripting.

Burp Proxy is the core interception component of Burp Suite, acting as a man-in-the-middle between the browser and the target web server. It is specifically designed to capture all HTTP and HTTPS traffic flowing through it, allowing security professionals to view, analyze, and modify requests and responses in real-time before they reach their destination. This real-time interception capability is fundamental for understanding application logic, identifying vulnerabilities, and manipulating data during penetration testing.

Reflected XSS occurs when a malicious script injected into an HTTP request is immediately returned in the server's HTTP response without being permanently stored. The payload is non-persistent, executing only once in the victim's browser as part of that specific request and response cycle. The observation that the application 'reflects' the input directly aligns with this immediate, one-time execution characteristic, making it the correct answer.

This is the most common and impactful exploitation path for SSRF when targeting cloud environments. Cloud providers like AWS, GCP, and Azure expose local metadata services (e.g., http://169.254.169.254 for AWS EC2) that provide critical information about the running instance, including temporary security credentials (IAM roles), network configuration, and user data. By leveraging SSRF to access these endpoints, an attacker can obtain sensitive credentials, potentially escalating privileges and gaining access to other cloud resources.

This precisely defines Server-Side Request Forgery (SSRF), a vulnerability where a web application is tricked into making HTTP requests to an attacker-specified location. The server, acting on behalf of the attacker, can then access internal network resources, metadata services, or other systems that are typically inaccessible from the external internet. This allows for internal network reconnaissance, port scanning, and potential data exfiltration by bypassing firewall restrictions.

Exploitation involves leveraging identified vulnerabilities to achieve a specific objective, such as gaining unauthorized access, escalating privileges, or exfiltrating sensitive data. Burp Suite Repeater is an indispensable tool for this phase, allowing testers to meticulously modify request parameters, headers, or body content with crafted payloads. This precision enables the confirmation and exploitation of vulnerabilities like SQL injection, cross-site scripting, or authentication bypasses by observing the server's direct, often vulnerable, responses.

Unrestricted file upload is the correct answer because it directly describes the vulnerability where a web application allows users to upload files without adequately validating their type, size, or content. This critical flaw enables an attacker to upload malicious files, such as web shells or scripts, to the server. Once uploaded, these files can often be executed by the web server, leading to severe consequences like remote code execution, server compromise, or defacement.

Inline comments, like '/**/', are valid SQL syntax that allows arbitrary text to be inserted without affecting query execution. By strategically placing these comments within keywords (e.g., 'UN/**/ION'), an attacker can break up the signature of a known malicious string (e.g., "UNION SELECT") into smaller, non-matching fragments. This technique effectively bypasses WAFs that rely on simple, exact string matching or regular expressions that do not account for such obfuscation, as the WAF sees 'UN', then '/**/', then 'ION', rather than the full "UNION" keyword.

Insecure Direct Object Reference (IDOR) occurs when an application exposes a direct reference to an internal implementation object, such as a file, directory, database record, or key, and fails to implement proper authorization checks. An attacker can manipulate these references, often found in URL parameters or API requests, to access resources belonging to other users or entities without explicit permission. This directly matches the scenario where an analyst changes an ID to view different responses, indicating a bypass of access controls.

XXE vulnerabilities allow an attacker to define external entities that reference local files on the server using the `file://` URI scheme. When the XML parser processes this entity, it attempts to retrieve the content of the specified file, such as `/etc/passwd` or application configuration files. This content is then embedded into the XML response, enabling the attacker to read sensitive system files.

Account lockout after 5 failed attempts can be circumvented by distributed attacks from many IPs. It is reactive and may cause denial of service for legitimate users, so it is not the best.

Directory traversal, also known as path traversal, is an attack that exploits insufficient security validation or sanitization of user-supplied input to access files and directories stored outside the intended web root directory. The `../` sequence, or its URL-encoded equivalent `%2e%2e%2f`, allows an attacker to navigate up the directory hierarchy. By chaining multiple `../` sequences, an attacker can potentially access sensitive system files like `/etc/passwd` or configuration files, thereby compromising the system's confidentiality.

If a web application reflects unsanitized user-controlled input, such as the User-Agent HTTP header, directly into the HTML response, it creates a reflected Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious client-side scripts (e.g., JavaScript) into the User-Agent string. When another user's browser renders this page, the injected script executes within their browser's security context, potentially leading to session hijacking, defacement, or redirection.

This is the precise definition of a password spraying attack. Attackers employ this technique by taking a small list of commonly used passwords (e.g., 'Password123', 'Summer2023!') and attempting each of these passwords against a large number of different user accounts within the same system. The primary goal is to avoid triggering account lockout thresholds, which are typically set per-account, by only attempting one or two passwords per user before moving on to the next account.

Reflected XSS occurs when user input is included in the response to the same request without proper output encoding, causing the browser to execute it. The tester's observation that the parameter is echoed back and executes when the crafted link is opened is the defining characteristic of this type.

SQLMap automates SQL injection exploitation and database fingerprinting, satisfying the stem's requirement for both capabilities in one tool. It detects injection points, identifies the backend database management system, and extracts data through techniques such as boolean-blind, time-blind, error-based and union-based injection, removing the need for manual payload crafting during penetration tests.

The Repeater tool in Burp Suite is specifically designed for manually modifying and reissuing individual HTTP requests. It allows security testers to fine-tune request parameters, headers, or body content and observe the server's response in real-time. This iterative process is crucial for exploring application logic, testing for specific vulnerabilities, or confirming exploit conditions step-by-step.

Credential stuffing is a highly effective attack where threat actors automate login attempts using large lists of username and password pairs previously compromised in data breaches from other services. If the web application allows valid usernames to be tested against these breached password lists without adequate detection or rate limiting, it becomes vulnerable to users who reuse their credentials across multiple platforms. This leverages the common user habit of password reuse.

Password spraying is a sophisticated attack technique where a small number of very common passwords are systematically tried against a *large number of different user accounts* or a single account from *many different IP addresses*. This method is specifically designed to evade account lockout thresholds by distributing attempts across many targets or sources, preventing any single account or IP from exceeding the lockout limit. The 'repeated login attempts' observed in logs align perfectly with this strategy, as attackers aim to find weak passwords without triggering immediate detection.

Insecure Direct Object Reference (IDOR) occurs when an application exposes a direct reference to an internal implementation object, such as a file, database key, or directory, and fails to implement proper authorization checks. An attacker can manipulate these references, often found in URL parameters, form fields, or API requests, to access or modify resources belonging to other users or unauthorized data. This vulnerability directly exploits the application's trust in user-supplied object identifiers without verifying the user's permission to access that specific object, leading to unauthorized information disclosure or modification.

Stored XSS, also known as persistent XSS, occurs when a malicious script is permanently saved on the target server, typically within a database, comment section, or user profile. When a victim's browser requests the page containing this stored payload, the server retrieves the malicious script and delivers it as part of the legitimate web page content. Consequently, the victim's browser executes the script, allowing the attacker to steal cookies, deface the website, or redirect users, making it a highly impactful and widespread attack.

Reflected Cross-Site Scripting (XSS) attacks are typically initiated when an attacker crafts a malicious URL containing the injected script and then tricks a victim into clicking it. This delivery mechanism is crucial because the malicious payload is not persistently stored on the server. Instead, the victim's browser sends the crafted URL to the vulnerable web application, which then reflects the script back in the immediate HTTP response, executing it in the victim's browser context.

Reflected Cross-Site Scripting (XSS) occurs when a malicious script, typically injected through a URL parameter or form input, is immediately processed by the server and returned within the HTTP response to the user's browser without proper sanitization. The script is not stored on the server; instead, it "reflects" off the server back to the user who made the request. The web server log showing the script directly in the request and implying an immediate response aligns perfectly with this non-persistent, server-side reflection mechanism.

Server-Side Request Forgery (SSRF) occurs when a web application is tricked into making requests to an arbitrary domain specified by an attacker. This vulnerability allows an attacker to induce the server-side application to make HTTP requests to an attacker-specified location, potentially targeting internal networks, cloud metadata services, or other external systems. The server acts as a proxy for the attacker, bypassing network segmentation or firewall rules that might otherwise block direct access.