During a penetration test, a tester finds that the web application being analyzed is vulnerable to Cross Site Scripting (XSS). Which of the following conditions must be met to exploit this vulnerability?
The web application does not have the secure flag set.
The session cookies do not have the HttpOnly flag set.
The victim user should not have an endpoint security solution.
The victim's browser must have ActiveX technology enabled.
Want to practice for 312-50 - Ethical Hacking and Countermeasures (CEHv6) ?