Reflected XSS WAHS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An attacker wants to exploit a reflected XSS vulnerability in a web application that is protected by a Web Application Firewall (WAF). The WAF blocks requests containing '<script>'. Which technique could the attacker use to bypass the WAF and deliver a payload?

   • AUse a null byte injection, such as <scr%00ipt>.
   • BUse an event handler such as <img src=x onerror=alert(1)> instead of a script tag.
   • CEncode the payload using URL encoding, such as %3Cscript%3Ealert(1)%3C/script%3E.
   • DSend the payload in a POST request instead of a GET request.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A developer is fixing a reflected XSS vulnerability in an application that reflects user input in both HTML and JavaScript contexts. The team wants to minimize code changes while ensuring security. Which approach is most effective?

   • AUse a WAF to filter all requests containing suspicious characters.
   • BImplement context-aware encoding by using different encoding functions for HTML and JavaScript contexts.
   • CUse a single output encoding function that HTML-encodes all user input before rendering.
   • DDisable JavaScript in the application's responses.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst is investigating a phishing campaign that uses a legitimate website's reflected XSS vulnerability. The attacker sends an email with a link to the legitimate site that includes a payload in a parameter. When the victim clicks the link, the site displays a fake login form that is actually part of the attacker's script. Which mitigation would be most effective in preventing this specific phishing technique?

   • ARequire users to enable two-factor authentication to access the site.
   • BImplement a Content Security Policy that restricts the sources from which scripts can be loaded.
   • CUse a web filter to block emails containing links to the legitimate site.
   • DAdd a warning banner to the site that says 'Do not enter credentials on pages that appear after clicking a link.'
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A developer is testing a web form that reflects the 'username' parameter in a welcome message. To confirm a reflected XSS vulnerability, which payload should be injected into the parameter?

   • A../../etc/passwd
   • B&param=value
   • C<script>alert(document.cookie)</script>
   • D'; DROP TABLE users; --
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is deploying a new web application and wants to prevent reflected XSS. The development team is considering using a Content Security Policy (CSP) as the primary defense. Which statement accurately describes the role of CSP in preventing reflected XSS?

   • ACSP is only effective for stored XSS, not reflected XSS.
   • BCSP can block the execution of injected scripts, but it does not address the root cause of the vulnerability.
   • CCSP prevents the reflection of user input in the response.
   • DCSP completely eliminates the need for output encoding.
   Reveal Solution Discussion Select an answer first