Reflected XSS WAHS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the typical attack flow for a reflected XSS attack?

   • AAttacker crafts a URL with a malicious payload; the victim clicks it; the server reflects the payload in the response; the browser executes it.
   • BAttacker modifies a DNS record to point a domain to a malicious server that serves the payload.
   • CAttacker stores a script in a forum post; any user viewing the post executes it.
   • DAttacker injects a script into a database; the server retrieves it and sends it to all users.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst discovers that a web application reflects the 'error' parameter in the page without encoding. An attacker crafts a URL that injects a script to redirect the user to a phishing page. What is the primary security impact of this reflected XSS attack?

   • ACredential theft via phishing, as the user is redirected to a fake login page.
   • BNetwork-level denial of service against the web server.
   • CUnauthorized access to the server's file system.
   • DServer-side data corruption due to the injected script.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a potential impact of a successful reflected XSS attack?

   • AThe attacker can modify the server's source code.
   • BThe attacker can steal the victim's session cookie and impersonate the victim.
   • CThe attacker can bypass the application's firewall.
   • DThe attacker gains direct access to the web server's file system.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How can an attacker use reflected XSS to perform phishing?

   • ABy sending a crafted email that contains a link to the vulnerable application's login page.
   • BBy using the server's email functionality to send emails to all users.
   • CBy injecting a script that redirects the user to a malicious site that mimics the legitimate application.
   • DBy modifying the application's DNS records to point to a malicious server.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An attacker exploits a reflected XSS vulnerability in a banking application. The attacker crafts a URL that, when clicked by a logged-in user, executes a script that sends a transfer request to the bank's API using the user's active session. Which impact is the attacker achieving?

   • AGaining persistent access to the user's account by installing a backdoor.
   • BStealing the user's password by displaying a fake login form.
   • CReading the user's session cookie from the server-side logs.
   • DPerforming unauthorized actions on behalf of the authenticated user, such as initiating a funds transfer.
   Reveal Solution Discussion Select an answer first