Ethical IT Discussion Reply

Apr 13th, 2015
Price: $5 USD

Question description

Can someone help write a 100 word response to the two questions


In Firefox, there is a way to find out a user's passwords using malicious script on a website. It uses a vulnerability in JavaScript to access the user's saved passwords list. It would be fairly simple for a casual user to go to a link that looks legitimate through an email or something, only to have the page run a malicious script to capture their passwords. To secure Firefox, it's important to make sure to not save passwords or any form information, which can be changed under security settings. Another important feature is to make sure that Firefox warns you when a site tries to install any software. 

Internet Explorer (at least the older versions) were notorious for having many vulnerabilities and being easy to exploit. Now, Microsoft has fixed many of those, but more are definitely around. The vulnerability for Firefox likely works as well for Internet Explorer, now that IE lets you save passwords and form data as well. IE makes cutomizing securiy fairly easy, with their 'security zones' feature. In addition to having more advanced options regarding ActiveX controls, etc., it also includes an intuitive slider that should probably be set to 'high' in most situations. 


XSS attacks can generally be categorized into two categories: stored and reflected. 

Stored attacks are those where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information. Stored XSS is also sometimes referred to as Persistent or Type-I XSS.

Reflected XSS Attacks

Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other web site. When a user is tricked into clicking on a malicious link, submitting a specially crafted form, or even just browsing to a malicious site, the injected code travels to the vulnerable web site, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a "trusted" server. Reflected XSS is also sometimes referred to as Non-Persistent or Type-II XSS.

In this example below, the attacker's ultimate goal is to steal the victim's cookies by exploiting an XSS vulnerability in the website. This can be done by having the victim's browser parse the following HTML code:


Tutor Answer

(Top Tutor) unicew
School: UIUC

Studypool has helped 1,244,100 students

Review from student
" Awesome! Exactly what I wanted. "
Ask your homework questions. Receive quality answers!

Type your question here (or upload an image)

1820 tutors are online

Brown University

1271 Tutors

California Institute of Technology

2131 Tutors

Carnegie Mellon University

982 Tutors

Columbia University

1256 Tutors

Dartmouth University

2113 Tutors

Emory University

2279 Tutors

Harvard University

599 Tutors

Massachusetts Institute of Technology

2319 Tutors

New York University

1645 Tutors

Notre Dam University

1911 Tutors

Oklahoma University

2122 Tutors

Pennsylvania State University

932 Tutors

Princeton University

1211 Tutors

Stanford University

983 Tutors

University of California

1282 Tutors

Oxford University

123 Tutors

Yale University

2325 Tutors