Reflected XSS WAHS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why might an automated scanner fail to detect a reflected XSS vulnerability?

   • AThe vulnerability requires a specific user interaction or context that the scanner does not replicate.
   • BThe scanner does not send HTTP requests to the target.
   • CThe scanner cannot access the internet.
   • DThe scanner only tests for SQL injection, not XSS.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security engineer is reviewing a web application that has a 'language' parameter used to display a localized greeting. The engineer notices that the parameter is reflected in the response without encoding. The application does not store the parameter. Which type of XSS is this, and what is the primary delivery mechanism?

   • AStored XSS; the attacker submits the payload to the server and it is saved for later display.
   • BReflected XSS; the attacker delivers the payload via a crafted URL that the victim is tricked into clicking.
   • CDOM-based XSS; the payload is processed entirely by client-side JavaScript without server involvement.
   • DBlind XSS; the payload executes when an administrator views the application logs.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A penetration tester is using an automated scanner to detect reflected XSS in a web application. The scanner reports a potential vulnerability in the 'q' parameter. What should the tester do to confirm the finding?

   • ARun the scanner again with the same payload to see if the result is consistent.
   • BManually inject a benign payload like <script>alert(1)</script> and observe if it executes in the browser.
   • CCheck the server logs to see if the payload was stored in a database.
   • DImmediately report the finding as a confirmed vulnerability without further testing.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An attacker wants to exploit a reflected XSS vulnerability in a banking website to steal credentials. The vulnerability is in the 'redirect' parameter, which is reflected in a JavaScript variable. Which delivery mechanism is most likely to be used?

   • ASending a crafted link via email or social media that the victim clicks.
   • BExploiting a DNS vulnerability to redirect the victim to a malicious site.
   • CUploading a malicious script to the website's server.
   • DIntercepting and modifying the victim's HTTP traffic.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which security header helps mitigate reflected XSS by preventing the browser from executing inline scripts?

   • AX-Frame-Options
   • BStrict-Transport-Security (HSTS)
   • CAccess-Control-Allow-Origin
   • DContent-Security-Policy (CSP)
   Reveal Solution Discussion Select an answer first