Question

John is analyzing an attack against his company in which the attacker found comments embedded in HTML code that provided the clues needed to exploit a software vulnerability. Using the STRIDE model, what type of attack did he uncover?

Answer 1

Information Disclosure

Step-by-step explanation:

Hello, the fact that the attacker was able to gather information from within the embedded HTML code suggests that the original developer did not properly store information, revealing potential issues or vulnerabilities in his/her design.

The STRIDE model stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Using the STRIDE model, one would say this would be a simple information disclosure attack, since the attacker used retrieved information to breach the system.

Cheer.