31. Which of the following attacks can a hacker use to execute code on a user's computer when the user visits a specially prepared, malicious website?
Answer: C
XSS
XSS, or Cross-Site Scripting, is an attack where a hacker injects malicious scripts into content from otherwise trusted websites. When a user visits a compromised website, the script can execute in their browser, allowing the hacker to run code on the user's computer.
A) DoS
Denial of Service (DoS) attacks aim to make a service unavailable to its intended users by overwhelming it with traffic. While disruptive, DoS attacks do not execute code on a user's computer nor do they involve the exploitation of web vulnerabilities like XSS does.
B) Spoofing
Spoofing involves impersonating another entity to deceive users, often through emails or websites. Although it can lead to phishing attacks, spoofing itself does not directly execute code on a user's computer, differentiating it from the capabilities of XSS.
C) XSS
Cross-Site Scripting (XSS) is specifically designed to allow attackers to inject and execute code in a user's browser when they visit a maliciously crafted webpage. This makes XSS a highly effective method for executing arbitrary code on the user's system, which is why it is the correct answer.
D) SQL injection
SQL injection is an attack that targets the database layer of an application by injecting malicious SQL code. While it can compromise the backend of a web application, it does not execute code directly on a user's computer in the way that XSS does.
Conclusion
XSS is the only attack method listed that allows hackers to execute code directly on a user's computer through their web browser. Other options, such as DoS, spoofing, and SQL injection, either focus on service disruption or backend manipulation without impacting the user's local environment directly. Therefore, XSS is the definitive correct answer for this question.