Web Application Attack Techniques and Exploitation EHE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   In a CSRF attack, what is the primary reason the victim's browser automatically includes authentication credentials with the forged request?

   • AThe server has misconfigured CORS headers
   • BThe browser automatically sends cookies for the target domain
   • CThe attacker has stolen the victim's session token
   • DThe victim's browser has been compromised by malware
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A web application allows users to upload images. The development team wants to prevent malicious file uploads that could lead to remote code execution. However, the application must support a wide variety of image formats, including SVG, which can contain scripts. Which of the following is the most effective approach?

   • AStore uploaded files with a .txt extension and serve them with a Content-Type of text/plain.
   • BAllow SVG uploads but strip all script tags and event handlers from the XML.
   • CUse a WAF to block requests containing SVG content.
   • DAllow only raster image formats (e.g., PNG, JPEG) and validate the file content by re-encoding the image server-side.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A web application allows users to input a URL that the server fetches to generate a preview. An attacker exploits this to access internal services. Which of the following is the most effective mitigation?

   • AValidate the URL against a whitelist of allowed domains and block requests to internal IP ranges.
   • BUse a blacklist of internal IP addresses and block requests to them.
   • CDisable the URL preview feature entirely.
   • DAdd a CAPTCHA to the URL input form.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A web application allows users to upload profile pictures. The developer wants to prevent attackers from uploading malicious files that could lead to remote code execution. Which of the following is the most effective control?

   • ARename the uploaded file to a random name with a .txt extension.
   • BUse a blacklist of dangerous extensions like .php, .asp, and .exe.
   • CValidate the file extension against a whitelist and store the file outside the web root.
   • DCheck the Content-Type header supplied by the client and reject any that are not image types.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A web application issues session cookies without the Secure and HttpOnly flags. A user logs in over HTTPS, but the application also serves some content over HTTP. An attacker on the same network wants to hijack the user's session. Which attack chain is most plausible?

   • AUse a network sniffer to capture the session cookie during an HTTP request, then replay it to impersonate the user.
   • BPerform session fixation by setting a known cookie value before the user logs in.
   • CUse CSRF to force the user to change their password and then log in.
   • DUse XSS to read the cookie via JavaScript, then send it to the attacker's server.
   Reveal Solution Discussion Select an answer first