This type of attack is used to deface websites virtually by adding extra HTML-based content.

This type of attack is used to deface websites virtually by adding extra HTML-based content.

• A. HTML Injection
• B. Server-side Includes
• C. HTML Embedding
• D. Server-side Template Injection

Answer: (C)

The essential idea is about placing extra HTML into the page’s output so the browser renders new content, altering how the page looks. When a web application outputs user-controllable data without escaping or sanitizing it, an attacker can embed HTML tags into the page. That embedded HTML becomes part of the rendered page, which is how defacement occurs—by adding or altering what the page displays using HTML elements. This is best described by embedding HTML into the page’s response, because the attacker’s goal is to have the browser render additional HTML that wasn’t intended by the original page. Other options involve server-side processing or templating logic, or describe a broader category of injection that doesn’t pinpoint the act of inserting HTML into the final output seen by users.

The essential idea is about placing extra HTML into the page’s output so the browser renders new content, altering how the page looks. When a web application outputs user-controllable data without escaping or sanitizing it, an attacker can embed HTML tags into the page. That embedded HTML becomes part of the rendered page, which is how defacement occurs—by adding or altering what the page displays using HTML elements.

This is best described by embedding HTML into the page’s response, because the attacker’s goal is to have the browser render additional HTML that wasn’t intended by the original page. Other options involve server-side processing or templating logic, or describe a broader category of injection that doesn’t pinpoint the act of inserting HTML into the final output seen by users.