DOM-based XSS WAHS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security consultant is assessing the risk of a DOM-based XSS vulnerability in a banking application. The vulnerable code is on the account summary page and uses location.hash to display a user's selected tab. The application uses HttpOnly cookies for session management. Which statement best describes the realistic impact of this vulnerability?

   • AThe attacker can only deface the page for the individual user, which is a low-severity issue.
   • BThe vulnerability has no impact because DOM-based XSS only affects the client-side and cannot interact with the server.
   • CThe attacker could potentially perform actions on behalf of the user, but cannot steal the session cookie due to HttpOnly; the impact is limited to actions that do not require the cookie to be read by JavaScript.
   • DThe attacker can fully hijack the user's session by stealing the HttpOnly cookie via JavaScript.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is reviewing a JavaScript-heavy single-page application. The code reads the value of `location.search` and passes it directly to `document.getElementById('output').innerHTML` without any validation. The analyst wants to confirm whether this is exploitable by testing in a browser. Which action would most directly demonstrate the vulnerability?

   • AModify the `document.cookie` value in the browser console and reload the page
   • BAppend `?q=<img src=x onerror=alert(1)>` to the URL and observe whether an alert dialog appears
   • CSubmit a form on the page with a crafted `action` attribute pointing to an attacker-controlled domain
   • DUse the browser's view-source feature to inspect the raw HTML response from the server
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   An application uses the following code: ``` var url = window.location.hash.substring(1); document.write('<a href="' + url + '">Click</a>'); ``` Which payload would exploit this DOM-based XSS to execute JavaScript?

   • A#"><img src=x onerror=alert(1)>
   • B#javascript:alert(document.cookie)
   • C#alert(1)
   • D#<script>alert(1)</script>
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which static analysis approach is most effective for identifying potential DOM-based XSS vulnerabilities in a JavaScript codebase?

   • AUsing a fuzzer to send random inputs to the application.
   • BRunning the application in a sandbox and observing network traffic.
   • CReviewing server-side code for input validation.
   • DSearching for dangerous sinks like innerHTML and eval, then tracing back to see if any source data reaches them.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A development team is fixing a DOM-based XSS vulnerability where user input from window.name is used to set an element's innerHTML. The team wants to implement a robust fix that addresses the root cause. Which approach is the most effective?

   • AAdd a Content Security Policy (CSP) that disallows inline scripts.
   • BValidate that the window.name value is alphanumeric and reject all other characters.
   • CReplace innerHTML with textContent when inserting the user-controlled value.
   • DEncode the value on the server side before it is sent to the client.
   Reveal Solution Discussion Select an answer first