Most Common Application-Level Attacks CASENET Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A .NET application has a search feature that uses a stored procedure to query a database. The stored procedure builds a dynamic SQL statement using the search term. The application also uses output caching for search results. An attacker submits a search term that causes the stored procedure to return all users. Which attack is this, and why is output caching a concern?

   • AInsecure deserialization; caching the serialized object could lead to RCE.
   • BXSS; caching the malicious script could execute in other users' browsers.
   • CCSRF; caching the forged request could repeat the attack.
   • DSQL injection; caching the malicious response could serve sensitive data to other users.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst reviews IIS logs for a .NET application and notices many requests to /Account/Login with a 'username' parameter containing strings like 'admin' OR '1'='1' and also requests with a 'returnUrl' parameter containing javascript:alert(1). Which two attack types are indicated by these log entries?

   • ASQL injection and cross-site scripting (XSS)
   • BCross-site request forgery (CSRF) and SQL injection
   • CCommand injection and LDAP injection
   • DInsecure deserialization and path traversal
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A .NET MVC application renders user-generated comments using @Html.Raw(Model.Comment). A user reports that their browser executes a script that steals cookies. Which vulnerability is being exploited, and what is the immediate fix?

   • AStored XSS; replace @Html.Raw with JavaScript encoding.
   • BDOM-based XSS; use HttpUtility.HtmlEncode on the server.
   • CReflected XSS; use @Html.Encode or the default Razor encoding.
   • DCSRF; add an anti-forgery token to the comment form.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A .NET application has a legacy endpoint that accepts XML and uses XmlDocument. The team is migrating to a new API that will accept JSON. The migration must be completed quickly, and the XML endpoint will remain for backward compatibility for six months. Which approach best balances security and business constraints?

   • ARemove the XML endpoint immediately and force all clients to use JSON.
   • BKeep the XML endpoint as-is and add a WAF rule to block XXE payloads.
   • CUse XmlDocument with a custom resolver that only allows internal entities.
   • DDisable DTD processing on the XML endpoint and use a JSON serializer with strict type handling for the new API.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A .NET application allows users to search for products. The search results page reflects the search term in the page title without encoding. An attacker crafts a URL that, when clicked, executes script in the user's browser. Which attack is this, and what is the best mitigation?

   • AOpen redirect; validate the redirect URL.
   • BStored XSS; sanitize the search term before storing.
   • CCSRF; add anti-forgery tokens.
   • DReflected XSS; HTML-encode the search term before rendering.
   Reveal Solution Discussion Select an answer first