DOM-based XSS WAHS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is evaluating the risk of a DOM-based XSS vulnerability in a public-facing website. The vulnerability allows an attacker to inject arbitrary JavaScript into the page. The website does not use HttpOnly cookies. Which statement best describes the most critical risk?

   • AThe attacker can steal session cookies and hijack user sessions, leading to unauthorized access to user accounts.
   • BThe attacker can deface the website for all users, causing reputational damage.
   • CThe attacker can only cause a denial of service by crashing the user's browser.
   • DThe attacker can read the website's source code and steal intellectual property.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How does Content Security Policy (CSP) help mitigate DOM-based XSS?

   • ACSP prevents the use of innerHTML and other dangerous sinks.
   • BCSP restricts the execution of inline scripts and eval() by default, limiting the impact of injected script.
   • CCSP automatically sanitizes all DOM inputs and outputs.
   • DCSP encrypts all data in the DOM to prevent theft.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a potential impact of DOM-based XSS in a web application that handles sensitive user data?

   • AAn attacker can modify server-side configuration files.
   • BAn attacker can read the contents of the server's database directly.
   • CAn attacker can cause a denial of service by consuming server resources.
   • DAn attacker can steal session cookies and impersonate the victim.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is comparing two XSS vulnerabilities. Vulnerability A is a reflected XSS in a search function. Vulnerability B is a DOM-based XSS in a client-side router. Both can be triggered by a crafted URL. Which statement best describes the key difference in how they are detected and fixed?

   • AVulnerability A is fixed with a WAF rule, while Vulnerability B is fixed with a CSP.
   • BVulnerability A is more severe because it is easier to exploit, while Vulnerability B is less severe.
   • CBoth vulnerabilities are fixed the same way by encoding all user input on the server side.
   • DVulnerability A can be detected by observing the payload in the server response and fixed with server-side output encoding; Vulnerability B requires client-side code review and fixing the unsafe DOM sink.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A developer is reviewing a web application for DOM-based XSS. The code reads a value from document.referrer and assigns it to an element's innerHTML property. Which combination of tools and techniques would be most effective to confirm this vulnerability?

   • AUse a static analysis tool that only scans server-side code for SQL injection patterns.
   • BUse a web proxy to intercept the HTTP request and modify the Referer header, then check the server's HTML response for the payload.
   • CUse an automated scanner that only sends payloads in the URL query string and checks the server response for reflections.
   • DUse a browser's developer tools to set a breakpoint on the innerHTML assignment, then navigate to the page from a crafted external link to observe the value in the debugger.
   Reveal Solution Discussion Select an answer first