CompTIA PenTest+ Practice Test

Which attack manipulates or compromises the logic of an application by injecting unintended content?

1. SQL injection

2. Cross-site scripting (XSS)

3. XML injection

4. Command injection

The correct answer is: XML injection

The concept behind XML injection focuses on manipulating the logic of applications that rely on XML for data exchange. This type of attack occurs when an attacker injects malicious XML content into a vulnerable application. The purpose of this is to disrupt the normal processing of XML data, which can lead to unauthorized actions or exposure of sensitive information. XML injection can exploit weaknesses in how an application interprets XML input, often targeting APIs or web services that utilize XML for communication. When the application fails to properly validate or sanitize the XML input, it becomes susceptible to injection attacks that can alter the intended logic of the application, allowing an attacker to gain control or extract information. While other options like SQL injection, Cross-site scripting, and Command injection are valid attack vectors, they operate with different principles and target different elements of software systems. SQL injection targets databases, Cross-site scripting manipulates web browsers and user sessions, and Command injection exploits command line tools. Each of these attacks involves specific types of content or contexts, whereas XML injection specifically alters the structure and semantics of XML data within applications.