Reflected XSS WAHS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A penetration tester is evaluating a web application that reflects the 'callback' parameter in a JSONP response. The application does not validate the callback parameter. Which attack is most likely to succeed?

   • AUsing a payload that modifies the server-side JSON data.
   • BUsing a payload that causes a denial of service on the server.
   • CUsing a payload that steals the server's private keys.
   • DInjecting a payload that breaks out of the JSONP callback and executes arbitrary JavaScript.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A web application is vulnerable to reflected XSS because it reflects user input in a JavaScript context without encoding. Which output encoding strategy is most appropriate for this context?

   • AJavaScript-encode the input by escaping quotes, backslashes, and other special characters.
   • BURL-encode the input using percent-encoding.
   • CBase64-encode the input before reflection.
   • DHTML-encode the input by converting < and > to &lt; and &gt;.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is assessing the impact of a reflected XSS vulnerability in a web application that uses HttpOnly cookies. The vulnerability allows an attacker to inject arbitrary JavaScript. Which impact is most likely despite HttpOnly cookies?

   • AThe attacker can modify the server-side session state.
   • BThe attacker can directly read the session cookie and hijack the session.
   • CThe attacker can still perform actions on behalf of the user by making authenticated requests from the victim's browser.
   • DThe attacker can bypass the HttpOnly flag by using a browser exploit.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard · select all that apply

   A security analyst is testing a web application for reflected XSS. The application reflects the 'name' parameter in the response. Which of the following techniques are valid for detecting and confirming reflected XSS? Select all that apply.

   • AUse a browser's developer tools to inspect the DOM and see if the payload is reflected unencoded.
   • BUse an automated scanner that sends payloads and analyzes the response for reflection.
   • CVerify that the payload is reflected in the response body without any encoding.
   • DCheck the server logs to see if the payload was stored in a database.
   • EInject a payload like <script>alert(1)</script> and observe if an alert dialog appears.
   Check answers Discussion Select an answer first
6. 5foundation · easy

   What is a key characteristic that distinguishes reflected XSS from stored XSS?

   • AReflected XSS can only be exploited if the application uses JavaScript on the client side.
   • BReflected XSS requires the payload to be stored in a database or file on the server.
   • CReflected XSS affects only the user who submits the request, never other users.
   • DReflected XSS is triggered only when the victim interacts with a crafted link or submits a crafted request.
   Reveal Solution Discussion Select an answer first