Clickjacking WAHS Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A penetration tester is assessing a web application for clickjacking vulnerabilities. The tester wants to use an automated tool that can quickly scan multiple pages and identify which ones are missing anti-framing headers. Which tool is most appropriate for this task?

   • AUse OWASP ZAP's active scanner with the 'Clickjacking' rule enabled.
   • BUse Burp Suite's Repeater tool to manually send requests to each page and inspect the response headers.
   • CUse the browser's built-in developer tools to inspect the network tab for each page.
   • DUse a custom JavaScript bookmarklet that loads the page in an iframe and checks if it breaks out.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security consultant is evaluating the risk of a clickjacking vulnerability in a banking application. The application allows users to transfer funds and change their contact information. The consultant notes that the application uses session cookies with the Secure and HttpOnly flags, and it does not send any anti-framing headers. Which statement best describes the risk to users?

   • AThe risk is low because the Secure flag on the session cookie prevents the cookie from being sent over HTTP, which blocks clickjacking.
   • BThe risk is moderate because the HttpOnly flag prevents the attacker from stealing the session cookie via JavaScript, which is the primary goal of clickjacking.
   • CThe risk is high because the attacker can read the user's account balance and transaction history displayed on the page.
   • DAn attacker can trick a logged-in user into performing unintended actions, such as transferring funds or changing their email address, by overlaying a transparent iframe on a decoy page.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which statement best describes how clickjacking deceives a user?

   • AIt injects malicious JavaScript into the target page to change the function of a button
   • BIt exploits a browser vulnerability to execute arbitrary code on the user's machine
   • CIt uses social engineering to convince the user to voluntarily disclose their credentials
   • DIt makes the user believe they are clicking a benign UI element while their click actually activates a hidden or disguised element from another page
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which HTTP response header is specifically designed to prevent a page from being displayed in an iframe?

   • AContent-Type
   • BContent-Security-Policy
   • CStrict-Transport-Security
   • DX-Frame-Options
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An online retailer's checkout page is vulnerable to clickjacking. An attacker creates a malicious site that frames the checkout page and tricks users into clicking the 'Place Order' button. What is the most likely impact on the user?

   • AThe user's credit card information is stolen from the checkout form
   • BThe user's browser is redirected to a phishing site
   • CThe user unintentionally places an order for an item they did not choose
   • DThe user's account is locked due to multiple failed login attempts
   Reveal Solution Discussion Select an answer first