DOM-based XSS WAHS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   How does DOM-based XSS differ from reflected XSS in terms of attack vector and execution location?

   • ADOM-based XSS uses a client-side source and executes in the browser; reflected XSS uses a server-side reflection of input and executes in the browser.
   • BDOM-based XSS only works with GET requests; reflected XSS only works with POST requests.
   • CDOM-based XSS requires the payload to be stored in a database; reflected XSS does not.
   • DDOM-based XSS executes on the server; reflected XSS executes in the browser.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A developer is using browser developer tools to investigate a potential DOM-based XSS vulnerability. The code reads a value from location.hash and writes it to the page using document.write. Which developer tools feature is most useful for tracing the data flow and confirming the vulnerability?

   • AUsing the Application tab to view cookies and local storage.
   • BUsing the Network tab to view the HTTP request and response headers.
   • CUsing the Console tab to run arbitrary JavaScript in the page context.
   • DSetting a breakpoint on the document.write line and using the debugger to inspect the value being written.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A penetration tester is exploiting a DOM-based XSS vulnerability. The application uses the following code: var url = new URL(window.location.href); var param = url.searchParams.get('redirect'); location.href = param;. The tester wants to achieve the highest impact. Which payload is the most effective?

   • Ajavascript:alert(document.cookie)
   • Bhttps://evil.com/phish
   • C//evil.com/phish
   • Dalert(document.cookie)
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is an effective mitigation against DOM-based XSS when you need to insert untrusted data into the DOM?

   • AUse document.write() to insert the data directly into the page.
   • BUse textContent instead of innerHTML to set text content.
   • CUse eval() to ensure the data is executed as JavaScript.
   • DUse innerHTML but only after removing all <script> tags.
   Reveal Solution Discussion Select an answer first
6. 30application · hard

   A development team is hardening a legacy web app that uses `eval()` to process a value from `location.hash`. The app must continue to support dynamic theming based on the hash value. Which mitigation is most appropriate?

   • ASanitize the hash value with a regular expression that removes all parentheses and semicolons before passing it to `eval()`
   • BReplace `eval()` with `JSON.parse()` and validate that the hash value is a valid JSON object before applying the theme
   • CAdd a `Content-Security-Policy` header with `script-src 'unsafe-eval'` to allow the existing code to run
   • DEncode the hash value with `encodeURIComponent()` before passing it to `eval()`
   Reveal Solution Discussion Select an answer first