Which exploitation vector targets web browsers through spearphishing links and drive-by compromises?

Which exploitation vector targets web browsers through spearphishing links and drive-by compromises?

• A. Office-Applications-Based Exploitation
• B. Web-Browser-Based Exploitation
• C. Third-Party Applications-Based Exploitation
• D. RemoteExec

Answer: (B)

Web-browser-based exploitation targets the browser itself as the entry point. Spearphishing links entice a user to click, sending them to a site or resource that hosts an exploit kit or compromised page. When the user visits, the browser or its plugins can be driven to execute malicious code, often through drive-by compromises that trigger automatically as the page loads. The attacker leverages vulnerabilities in the browser or installed plugins to install malware or establish a foothold, sometimes with little or no additional user interaction after the initial click. This focus on exploiting the browser through links and drive-by downloads distinguishes it from office document exploits or other application targets, and from remote command execution scenarios.

Web-browser-based exploitation targets the browser itself as the entry point. Spearphishing links entice a user to click, sending them to a site or resource that hosts an exploit kit or compromised page. When the user visits, the browser or its plugins can be driven to execute malicious code, often through drive-by compromises that trigger automatically as the page loads. The attacker leverages vulnerabilities in the browser or installed plugins to install malware or establish a foothold, sometimes with little or no additional user interaction after the initial click. This focus on exploiting the browser through links and drive-by downloads distinguishes it from office document exploits or other application targets, and from remote command execution scenarios.