What Are Two Targets in Cross-Site Scripting Attacks?

Why the Answer Is Correct

In Cisco's SCOR 350-701 treatment of cross-site scripting, the attacker's objective is stated in terms of what gets compromised inside the victim's browser session, and the two assets repeatedly named are the user's cookie and the application's input. The cookie is the prize because it holds the session identifier; a script such as document.cookie read-out lets the attacker ride an authenticated session without ever cracking a password. Input is the second target because form fields, search boxes, comment forms, and URL parameters are the untrusted data that the application reflects or stores, and controlling that input is what lets the injected script execute in other users' browsers. Both options fit the question's wording "targets" — the things the attacker is trying to reach and abuse — and no other option describes an asset a script can read or manipulate. That is why B and C form the expected pair.

Why the Other Options Are Wrong

A footer (A) is static page markup with no session value and no trust boundary; stealing or altering a footer gains an attacker nothing, which is why it never appears in the XSS target list. A header (D) can occasionally carry a reflected payload, for example in a User-Agent or Referer field echoed back into the response, but in that scenario the header is a transport path for the payload, not the asset the script is trying to obtain. An image (E) is likewise a vector: a malicious img tag, an onerror handler, or a poor image-upload validation routine can deliver or hide a script, but the image itself is not what the attacker wants. This vector-versus-target distinction is precisely what the distractors here are built to test.

Community Comment Notes

Premium_Pils captured the intended logic plainly, writing that "the targets are the cookie or a user input" and adding that the methods of getting them — modifying an image-type input or an HTTP request header — are separate from the targets themselves. That is the strongest signal in the thread, and Surfside92 reinforced it by pointing to the Cloudflare learning article on cross-site scripting rather than to any image- or header-based argument. The CE voters, including luismg and d357f61, argued that XSS "can be caused due to poor input validation or through non image validation," which is a fair statement about injection vectors but answers a different question than "what are the targets." kloug simply confirmed "Answer b,c." The vote split (BC 75, CE 25) reflects exactly that confusion between vector and target, not a genuine dispute over the Cisco answer.