CompTIA PenTest+ Practice Test

What distinguishes a DOM-based XSS attack from other XSS attack types?

1. It manipulates the server directly

2. It is based solely on client-side JavaScript execution

3. It relies on user input in forms

4. It stores scripts on the server

The correct answer is: It is based solely on client-side JavaScript execution

A DOM-based XSS attack is characterized by its reliance on client-side JavaScript execution. This type of attack does not interact with the server to execute malicious scripts; instead, it manipulates the Document Object Model (DOM) of the page in the user's browser. The attack occurs when client-side code dynamically writes data into the webpage, allowing an attacker to execute scripts if the page does not properly sanitize user input. This distinguishes it from other types of XSS attacks, such as stored XSS, which injects scripts that are stored on the server and run when the data is retrieved, or reflected XSS, which relies on the server reflecting inputs immediately back to the user without an intermediate storage. Additionally, while user input can be involved in DOM-based XSS attacks, such as manipulating URLs or data attributes, the defining feature remains the execution happening entirely on the client side.