Which two vulnerabilities are explicitly named as targets of the WebApp Security Scanner in the material?

Which two vulnerabilities are explicitly named as targets of the WebApp Security Scanner in the material?

• A. SQL injection
• B. XSS
• C. SQL injection and XSS
• D. SQL injection and XSS and known attacks

Answer: (C)

Web application scanners aim to find the flaws that arise when untrusted input is mishandled by an app. The material explicitly names two vulnerabilities as targets: SQL injection and cross-site scripting (XSS). SQL injection occurs when user-supplied data is used to build a SQL query without proper validation or parameterization, allowing an attacker to alter queries, access or modify data, or bypass authentication. XSS happens when an application includes untrusted input in its HTML output without proper escaping, enabling attacker-provided scripts to run in other users’ browsers, potentially stealing cookies or session tokens or performing actions on behalf of the victim. These two are highlighted because they are among the most common and impactful injection-based flaws that scanners are designed to detect. The other options either mention only one vulnerability or add terms that aren’t vulnerabilities, so they don’t match what the material identifies as targets.

Web application scanners aim to find the flaws that arise when untrusted input is mishandled by an app. The material explicitly names two vulnerabilities as targets: SQL injection and cross-site scripting (XSS). SQL injection occurs when user-supplied data is used to build a SQL query without proper validation or parameterization, allowing an attacker to alter queries, access or modify data, or bypass authentication. XSS happens when an application includes untrusted input in its HTML output without proper escaping, enabling attacker-provided scripts to run in other users’ browsers, potentially stealing cookies or session tokens or performing actions on behalf of the victim. These two are highlighted because they are among the most common and impactful injection-based flaws that scanners are designed to detect. The other options either mention only one vulnerability or add terms that aren’t vulnerabilities, so they don’t match what the material identifies as targets.