Reflected XSS WAHS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which statement best defines reflected XSS?

   • AMalicious script is embedded in a request and reflected in the response without being stored on the server.
   • BMalicious script is executed in the context of the server-side application, not the client's browser.
   • CMalicious script is delivered through a DOM property without ever appearing in the HTTP response.
   • DMalicious script is stored on the server and executed when any user views the affected page.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security analyst is comparing the risk of reflected XSS versus stored XSS in a web application. The application has a search function that reflects queries and a comment section that stores user input. Both are vulnerable. Which statement correctly compares the risk and exploitation of these two vulnerabilities?

   • AStored XSS is generally considered higher risk because it can affect many users without requiring them to click a crafted link.
   • BReflected XSS is higher risk because it can be delivered via email and does not require the attacker to have access to the application.
   • CBoth vulnerabilities have the same risk because they both allow arbitrary script execution in the user's browser.
   • DReflected XSS is higher risk because it is easier to exploit and does not require user interaction.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An attacker crafts a URL that contains a malicious script in a parameter. The attacker sends this link to a victim via email. When the victim clicks the link, the script executes in the victim's browser and sends the victim's session cookie to the attacker's server. Which step in the attack flow is the attacker primarily exploiting?

   • AThe application stores the parameter in a database and later displays it to other users.
   • BThe victim's browser automatically executes any script included in a URL query string.
   • CThe attacker is using a man-in-the-middle attack to modify the HTTP response before it reaches the victim.
   • DThe application reflects the parameter value in the response without encoding, allowing the script to execute.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A development team is fixing a reflected XSS vulnerability in a legacy application. The application uses server-side rendering and reflects user input in HTML attributes. Which defense-in-depth approach is most appropriate?

   • ADisable JavaScript in the application's rendered pages.
   • BRely solely on a Web Application Firewall (WAF) to filter requests.
   • COnly use input validation to block known malicious patterns.
   • DImplement context-aware output encoding and add a Content Security Policy (CSP) header.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A penetration tester is assessing a web application that uses HttpOnly cookies for session management. The tester finds a reflected XSS vulnerability. Which impact is most likely to be achieved despite the HttpOnly flag?

   • AReading the user's browsing history and sending it to the attacker.
   • BStealing the session cookie via JavaScript and sending it to an external server.
   • CPerforming actions on behalf of the user, such as changing account settings or making purchases.
   • DInstalling a keylogger on the user's machine to capture future keystrokes.
   Reveal Solution Discussion Select an answer first