* XSS Attack Explanation:
* The payload exploits Cross-Site Scripting (XSS) by injecting obfuscated JavaScript into the application. When rendered, the browser executes the malicious code (e.g., alert('pwned')).
* Obfuscation (<sCRitP> instead of <script>) attempts to bypass naive input filters.
* Countermeasure:
* Implement input sanitization to ensure all user inputs are properly validated and escaped before being processed or rendered.
* Other measures include using Content Security Policies (CSP) and output encoding.
* Why Not Other Options?
* A: This is not arbitrary code execution; it is a browser-based attack.
* B: XSS is unrelated to SQL injection.
* C: Cross-Site Request Forgery (CSRF) is a different vulnerability targeting session handling, not script injection.
CompTIA Pentest+ References:
* Domain 3.0 (Attacks and Exploits)
* OWASP XSS Prevention Cheat Sheet