In a DOM-based XSS vulnerability, where does the untrusted data typically originate and where does it end up?

From a cookie to a CSS style property.

From a DOM source (e.g., location.search) to a dangerous sink (e.g., eval).

From a user input field to a server-side log file.

From a server-side database to an HTML attribute in the response.

EC-CouncilWeb Application Hacking and Security

Domain 3Objective 3

DOM-based XSS WAHS Practice Questions (Page 7)

Part of the Cross-Site Scripting (XSS) domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

Questions 31–32

31foundation · easy
Which of the following is an example of a dangerous DOM sink that can lead to script execution if it receives untrusted data?
Select an answer first
32foundation · easy
In a DOM-based XSS vulnerability, where does the untrusted data typically originate and where does it end up?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

DOM-based XSS WAHS Practice Questions (Page 7)

Questions 31–32

Which of the following is an example of a dangerous DOM sink that can lead to script execution if it receives untrusted data?

In a DOM-based XSS vulnerability, where does the untrusted data typically originate and where does it end up?

Keep studying — Cross-Site Scripting (XSS)