Three web application attacks appear on almost every Security+ exam: SQL injection, cross-site scripting (XSS) and cross-site request forgery (CSRF). All three abuse the way a web application trusts either the data it receives or the browser that sends it. They matter because web applications are exposed to the whole internet, and a single vulnerable form can leak an entire customer database or let an attacker act as a logged-in user. The exam focuses on telling them apart and picking the right defense for each, rather than on writing the attacks.
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 7 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.