Exam 312-50v13 topic 1 question 217 discussion

Answer: D I’m choosing D) because other answers are unrealistic and useless but D) also won’t work as presented in the answer because when user is redirected to the malicious site, then only cookies belonging to the TARGET SITE are sent with the request (if some exists in the browser) but NOT cookies belonging to the SOURCE SITE which we are hacking. So attacker won't get the cookies in question with HttpOnly flag. Anyway, the malicious site can be useful for another hacks then...

The correct answer is: D. Create a sophisticated XSS payload that leverages HTML encoding to bypass the input sanitization, and then use it to redirect users to a malicious site where their cookies can be captured. Explanation: The scenario involves a web application vulnerable to Cross-Site Scripting (XSS) that sanitizes inputs against standard XSS payloads but fails to filter out HTML-encoded characters. Additionally, the application uses HTTPOnly cookies, which prevent client-side scripts (like JavaScript) from accessing the cookies directly. Here's why option D is the most viable strategy:

HTML Encoding to Bypass Input Sanitization: Since the application fails to filter out HTML-encoded characters, you can craft an XSS payload that uses HTML encoding to bypass the input sanitization. Redirecting Users to a Malicious Site: By redirecting users to a malicious site, you can capture their session cookies through other means, such as social engineering or exploiting vulnerabilities on the malicious site. This approach circumvents the HTTPOnly restriction, as the cookies are not directly accessed by the script but are instead sent to the malicious site.