2.6 Describe Web Application Attacks, Such as SQL Injection, Command Injections, and Cross-Site Scripting 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A web application takes a user-supplied product ID and inserts it directly into a SQL query string. An attacker enters `' OR '1'='1` as the product ID. What is the primary result of this type of attack?

   • AThe application executes an unintended SQL query that may return all rows from the table.
   • BThe application stores the input in a cookie for later use.
   • CThe application displays an error page that reveals the database server's IP address.
   • DThe application executes a second query that deletes the entire table.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A user posts a comment on a blog that contains a malicious JavaScript snippet. When other users view the comment, the script executes in their browsers. Which type of XSS attack is this?

   • ASQL injection
   • BDOM-based XSS
   • CStored XSS
   • DReflected XSS
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is investigating a series of alerts. The application has a page that uses JavaScript to update the DOM based on the `window.location.hash` value. An attacker crafts a URL like `https://example.com/#<img src=x onerror=alert(document.cookie)>`. The page loads and the script executes, but the server logs show no request for the malicious payload. Which type of attack is this, and why is it difficult to detect in server logs?

   • AStored XSS; the payload is stored in the database and served to all users.
   • BCommand injection; the payload is executed by the operating system.
   • CDOM-based XSS; the payload is processed entirely by client-side JavaScript and never sent to the server.
   • DReflected XSS; the payload is reflected in the server response and can be detected by inspecting response bodies.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is investigating a breach. The attacker used a login form to submit `' OR '1'='1` and gained access to an administrative account. The application logs show that the query executed was `SELECT * FROM users WHERE username='' OR '1'='1' AND password='...'`. Which of the following best describes the attack and the most effective remediation?

   • ACommand injection; sanitize the login form to remove quotes.
   • BSQL injection; rewrite the authentication query to use parameterized statements.
   • CSQL injection; disable the database error messages to hide the query.
   • DCross-site scripting; encode the username field before storing it.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which statement best describes how command injection attacks work?

   • AThey inject malicious packets into the network to hijack a TCP session.
   • BThey inject malicious SQL code into database queries to extract sensitive data.
   • CThey inject malicious scripts into web pages that run in other users' browsers.
   • DThey inject malicious shell commands into application inputs that are passed to the operating system.
   Reveal Solution Discussion Select an answer first