CORS Misconfiguration WAHS Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   To exploit a CORS misconfiguration to read sensitive data from a victim's authenticated session, what must the attacker's malicious page do?

   • AInject a script into the target site to read the response from within the same origin.
   • BSend a request from the attacker's server directly to the target site using the victim's IP address.
   • CUse a DNS rebinding attack to bypass the Same-Origin Policy.
   • DMake a cross-origin request to the target site with credentials included and then read the response.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A web application makes a cross-origin request to an API. The browser sends an OPTIONS preflight request. Which response header is essential for the browser to allow the actual request to proceed?

   • AAccess-Control-Expose-Headers
   • BAccess-Control-Allow-Credentials
   • CAccess-Control-Max-Age
   • DAccess-Control-Allow-Origin
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A penetration tester finds that an API returns Access-Control-Allow-Origin: null when the Origin header is null. The API also sets Access-Control-Allow-Credentials: true. Which attack scenario is most likely to succeed?

   • AA DNS rebinding attack changes the Origin header to null
   • BAn attacker uses a browser extension to force the Origin header to null
   • CA regular website at https://evil.com sends a fetch request with credentials
   • DA sandboxed iframe or a request from a data: URL sends a request with Origin: null
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A penetration tester is exploiting a CORS misconfiguration in an application that uses cookie-based authentication. The tester wants to exfiltrate the victim's data to an attacker-controlled server. Which technique is most effective?

   • AUse a hidden iframe to load the API and read the response via the iframe's contentDocument.
   • BUse JavaScript on the malicious site to fetch the API with credentials: 'include' and send the response to the attacker's server.
   • CUse a DNS rebinding attack to make the malicious site appear as the API's origin.
   • DUse an HTML form to submit a request to the API and read the response via the form's action.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A developer is implementing CORS for an API that uses session cookies. The API must be accessible from two subdomains: app.example.com and admin.example.com. Which configuration is most secure?

   • ASet Access-Control-Allow-Origin to * and rely on the SameSite cookie attribute for protection
   • BSet Access-Control-Allow-Origin to https://app.example.com and https://admin.example.com in the same response
   • CUse a regex that matches any subdomain of example.com
   • DCheck the Origin header against an exact allowlist of the two subdomains and echo the matching origin
   Reveal Solution Discussion Select an answer first