CompTIA PenTest+ Practice Test

Which of the following XSS attacks is characterized by malicious scripts executing solely on the client?

1. Persistent XSS attack

2. Reflected XSS attack

3. DOM-based XSS attack

4. Server-side XSS attack

The correct answer is: DOM-based XSS attack

The characteristic that defines DOM-based XSS attacks is that the malicious scripts execute entirely on the client side, without any interaction from the server to reflect or store the script. In this type of attack, the vulnerability arises from the web page's client-side scripts, mainly from the way the Document Object Model (DOM) is manipulated. Attackers exploit this by injecting malicious JavaScript code that affects only the users who visit the affected webpage, running in the user's browser and not needing server-side processing. In a DOM-based XSS scenario, the attacker typically takes advantage of client-side scripts which read data from the URL, form input fields, or other client-stored data. They can create a situation where user input is not properly sanitized, leading to script execution in the context of the current page. This is distinct from other types of XSS attacks, which may involve server responses or stored malicious scripts that affect the data sent back to the client. Understanding this distinction is crucial for recognizing vulnerabilities in web applications and implementing appropriate defenses.