Which attack targets client-side components to execute code in the user's context when visiting a malicious page?

Which attack targets client-side components to execute code in the user's context when visiting a malicious page?

• A. Frame Injection
• B. SOAPAction
• C. ActiveX Attack
• D. Web API

Answer: (C)

Sending code execution through a component that runs inside the user’s browser is the hallmark of an ActiveX Attack. ActiveX controls are client-side components on Windows that can execute with the user’s privileges when a page loads or a control is activated. If a malicious page serves a vulnerable or unsigned ActiveX control, the browser can instantiate it and run arbitrary code in the user’s context, which is exactly the scenario described. Frame Injection involves manipulating or loading frames to alter what a user sees or to capture input, but it doesn’t inherently rely on exploiting a vulnerable client-side component to execute new code in the user’s environment. SOAPAction is simply a header used in SOAP web services and isn’t an attack vector. Web API refers to browser interfaces for web pages and also isn’t a specific attack technique.

Sending code execution through a component that runs inside the user’s browser is the hallmark of an ActiveX Attack. ActiveX controls are client-side components on Windows that can execute with the user’s privileges when a page loads or a control is activated. If a malicious page serves a vulnerable or unsigned ActiveX control, the browser can instantiate it and run arbitrary code in the user’s context, which is exactly the scenario described.

Frame Injection involves manipulating or loading frames to alter what a user sees or to capture input, but it doesn’t inherently rely on exploiting a vulnerable client-side component to execute new code in the user’s environment. SOAPAction is simply a header used in SOAP web services and isn’t an attack vector. Web API refers to browser interfaces for web pages and also isn’t a specific attack technique.