What type of attack does the attacker infect a website that is often visited by target users?

Man In The Middle attack:
In cryptography and computer security, a man-in-the-middle attack is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other.

Cross-site scripting [XSS]:
Cross-site scripting is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.

Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF [sometimes pronounced sea-surf] or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts.

Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF [sometimes pronounced sea-surf] or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts.

C. Social engineering techniques

E. System/application misconfiguration

Address Resolution Protocol poisoning[ARP poisoning] is a form of attack in which an attacker changes the Media Access Control [MAC] address and attacks an Ethernet LAN by changing the target computer's ARP cache with a forged ARP request and reply packets.

DEFINITION
DNS amplification attack

 How to attack DDoS threats with a solid defense plan
//whatis.techtarget.com/definition/DNS-amplification-attack

A DNS amplification attack is a reflection-based distributed denial of service [DDos] attack.

The attacker spoofs look-up requests to domain name system [DNS] servers to hide the source of the exploit and direct the response to the target. Through various techniques, the attacker turns a small DNS query into a much larger payload directed at the target network.

The attacker sends a DNS look-up request using the spoofed IP address of the target to vulnerable DNS servers. Most commonly, these are DNS servers that support open recursive relay. The original request is often relayed through a botnetfor a larger base of attack and further concealment. The DNS request is sent using the EDNS0 extension to the DNS protocol allowing for large DNS messages.  It may also use the DNS security extension [DNSSEC] cryptographic feature to add to the size of the message.

These amplifications can increase the size of the requests from around 40 bytes to above the maximum Ethernet packet size of 4000 bytes. This requires they be broken down for transmission and then reassembled, requiring further target network resources.  A botnet's many amplified requests enable an attacker to direct a large attack with little outgoing bandwidth use. The attack is hard to protect against as it comes from valid-looking servers with valid-looking traffic.

DNS amplification is one of the more popular attack types.  In March 2013, the method was used to target Spamhauslikely by a purveyor of malware whose business the organization had  disrupted by blacklisting. The anonymity of the attack was such that Spamhaus is still unsure of the source. Furthermore, the attack was so severe that it temporarily crippled and almost brought down the Internet.

Proposed methods to prevent or mitigate the impact of DNS amplification attacks include rate limiting, blocking either specific DNS servers or all open recursive relay servers, and tightening DNS server security in general.

Man In The Browser