312-50 Question 339
Single answer▪ Attack Web App ClientDuring an authorized CEH web application assessment, you need to demonstrate a client-side attack path against employees who use a legacy browser environment. The target application allows users to upload profile images, and the images are later viewed by other authenticated users in their browsers. Your goal is to execute JavaScript in another user's browser without relying on server-side code execution. Which testing approach is the most appropriate to validate this risk?
- A
Upload a file containing HTML/JavaScript disguised as an image and determine whether the application serves it with an unsafe Content-Type or allows active content to be rendered in the victim's browser
- B
Run a SQL injection attack against the image upload form to extract session cookies from the database
- C
Perform an ARP spoofing attack on the internal network so you can intercept image requests and modify them in transit
- D
Exploit the web server with a buffer overflow to gain shell access and then alter the stored image files directly
Show answer and explanation
Correct answer: A
Explanation
The best answer is the file upload active-content test because the scenario is specifically about attacking the web application client, meaning the victim's browser is the target. In real assessments, testers commonly evaluate whether uploaded files can be used to deliver stored XSS or HTML/script content to other users. This includes checking file extension validation, content sniffing behavior, MIME type handling, and whether user-uploaded content is stored under the same origin and later rendered by the browser. OWASP guidance on File Upload Security and Cross Site Scripting prevention is relevant here: applications should strictly validate file types, store uploads outside the web root where possible, serve them with safe Content-Type headers, and prevent browsers from interpreting untrusted files as active content. This question tests whether the candidate can distinguish a true client-side web attack from unrelated server-side, database, or network-layer attacks.
- A. Correct.
Correct. This directly tests a realistic web app client attack scenario involving stored client-side payload delivery through uploaded content. If the application fails to validate file type, stores user-controlled files in a web-accessible location, or serves uploaded content with an unsafe MIME type such as text/html instead of image/*, a victim viewing the file may execute attacker-supplied JavaScript. This is aligned with stored XSS or active content upload testing and is a practical method for demonstrating browser-side impact without requiring server compromise.
- B. Incorrect.
Incorrect. SQL injection targets the backend database layer, not the client-side rendering behavior of uploaded content. Also, session cookies are not typically retrieved from a database through SQL injection in this way. A candidate might choose this because it is a common web attack, but it does not directly validate a web app client attack via content rendered in the victim's browser.
- C. Incorrect.
Incorrect. ARP spoofing is a network-level man-in-the-middle technique, not the most appropriate method for validating whether the application itself can deliver malicious client-side content to authenticated users. Although it can be used to manipulate traffic in some environments, it does not test the application's file handling and browser rendering weaknesses, which are the focus here.
- D. Incorrect.
Incorrect. A buffer overflow against the web server is a server-side exploitation path and is outside the scope of demonstrating a client-side attack delivered through normal application functionality. It also assumes a much more severe and unrelated vulnerability. Someone might choose it because it could ultimately enable file tampering, but it is not the proper way to validate the specific client attack scenario.