Eccouncil Exam 312-96 Topic 1 Question 20 Discussion

Actual exam question for Eccouncil's 312-96 exam

Question #: 20
Topic #: 1

Thomas is not skilled in secure coding. He neither underwent secure coding training nor is aware of the consequences of insecure coding. One day, he wrote code as shown in the following screenshot. He passed 'false' parameter to setHttpOnly() method that may result in the existence of a certain type of vulnerability. Identify the attack that could exploit the vulnerability in the above case.

ADenial-of-Service attack

BClient-Side Scripts Attack

CSQL Injection Attack

DDirectory Traversal Attack

Show Suggested Answer

Suggested Answer: B

by Rhea at Jun 29, 2024, 04:05 AM

Limited Time Offer

25%

Off

Get Premium 312-96 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ammie

8 months ago

Ah, good old Thomas and his questionable coding practices. I bet this is a classic Client-Side Scripts Attack. Though, knowing Thomas, he might have accidentally stumbled into a Directory Traversal Attack instead. Stranger things have happened!

upvoted 0 times

Amina

7 months ago

Either way, it's a serious vulnerability that needs to be addressed.

upvoted 0 times

...

Freida

7 months ago

Maybe he accidentally triggered a Directory Traversal Attack instead.

upvoted 0 times

...

Domingo

7 months ago

I agree, Thomas really needs to improve his secure coding skills.

upvoted 0 times

...

Jospeh

7 months ago

I think it's a Client-Side Scripts Attack.

upvoted 0 times

...

Carisa

8 months ago

Oof, Thomas strikes again! Passing 'false' to setHttpOnly() is a rookie move. I'm going to go with B) Client-Side Scripts Attack on this one. Gotta love Thomas and his secure coding skills, or lack thereof.

upvoted 0 times

...

Edna

8 months ago

Hmm, the screenshot shows some sketchy code. I'm guessing it's a Client-Side Scripts Attack, but you never know with Thomas. He seems more likely to accidentally create a Denial-of-Service than a SQL Injection, if you ask me.

upvoted 0 times

Brittni

8 months ago

Yeah, Thomas should really get some secure coding training.

upvoted 0 times

...

Lorean

8 months ago

I think it's a Client-Side Scripts Attack.

upvoted 0 times

...

Wilda

9 months ago

I believe the correct answer is B) Client-Side Scripts Attack because it can manipulate the client-side code.

upvoted 0 times

...

Colette

9 months ago

Wow, that's a tricky one! Passing 'false' to setHttpOnly() seems like a recipe for disaster. I bet it's a Client-Side Scripts Attack, but I'd need to double-check the details.

upvoted 0 times