Attackers analyze the HTML source code to locate URLs to target S3 buckets.

Attackers analyze the HTML source code to locate URLs to target S3 buckets.

• A. SQL Injection
• B. DNS Spoofing
• C. Inspecting HTML
• D. Cross-site Scripting

Answer: (C)

Inspecting HTML for embedded resource links is a reconnaissance technique. By viewing the page’s markup or source code, an attacker can discover where the site references external resources, such as links to storage buckets like S3. This helps map the target’s infrastructure and identify any publicly accessible endpoints that might expose data or be usable in further attacks. Recognizing these URLs can reveal misconfigurations or weak access controls, making it crucial to limit public exposure, enforce proper bucket policies, and use access-restriction mechanisms. This isn’t about manipulating inputs to run SQL, spoofing or altering DNS responses, or injecting scripts for execution in a user’s browser. It’s about quietly gathering information from the HTML itself to understand what resources the site uses.

Inspecting HTML for embedded resource links is a reconnaissance technique. By viewing the page’s markup or source code, an attacker can discover where the site references external resources, such as links to storage buckets like S3. This helps map the target’s infrastructure and identify any publicly accessible endpoints that might expose data or be usable in further attacks. Recognizing these URLs can reveal misconfigurations or weak access controls, making it crucial to limit public exposure, enforce proper bucket policies, and use access-restriction mechanisms.

This isn’t about manipulating inputs to run SQL, spoofing or altering DNS responses, or injecting scripts for execution in a user’s browser. It’s about quietly gathering information from the HTML itself to understand what resources the site uses.