I have a question concerning an ethical hacking class:

When should the initial penetration test be performed on a web server and Why? With that can you please compare and contrast a cross-site scripting attack and a reflective cross-site scripting attack Another thing I need help with is \what Web application attacks are most likely to compromise confidentiality and the techniques can you use to mitigate and respond to SQL injection attacks?