Stored XSS WAHS Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is investigating a suspected Stored XSS attack. The attacker posted a message that includes a script. The analyst wants to confirm that the script executes for other users. Which observation would provide the STRONGEST evidence?

   • AThe attacker's browser receives a response from the server.
   • BThe server logs show a POST request containing the script.
   • CThe message is stored in the database with the script tag.
   • DA request to an external server is made from a different user's browser when they view the message.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security auditor discovers a Stored XSS vulnerability in a legacy web application. The application is scheduled for replacement in six months, and the team needs a quick mitigation that reduces risk without a full rewrite. Which control should be prioritized?

   • ADisable JavaScript in all client browsers.
   • BAdd a Content Security Policy that blocks inline scripts and restricts script sources.
   • CRemove all user-generated content features.
   • DRewrite the entire application using a modern framework.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard · select all that apply

   A security consultant is assessing a web application for Stored XSS. Which of the following are common injection points for Stored XSS? Select all that apply.

   • AComment sections on blog posts or articles.
   • BHTTP request headers such as User-Agent.
   • CURL query parameters that are reflected in the page.
   • DUser profile fields such as 'display name' or 'bio'.
   Check answers Discussion Select an answer first
5. 14application · medium

   A developer is reviewing code for potential Stored XSS vulnerabilities. Which code pattern is MOST likely to be vulnerable?

   • AA file upload feature that stores files on the server.
   • BA comment form that saves user input to a database and later inserts it into an HTML page without encoding.
   • CA login form that compares user input to a database value.
   • DA search page that displays the search term in the page title.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A penetration tester is testing a web application for stored XSS. The application has a comment field that is rendered in an HTML context. The tester submits the payload <script>alert(1)</script> and it is stored, but the alert does not fire when viewing the comment. The tester then submits the payload <img src=x onerror=alert(1)> and the alert fires. What is the most likely reason for this difference?

   • AThe tester's browser has a pop-up blocker that blocks the alert from the script tag but not from the img tag.
   • BThe application filters or encodes the <script> tag but allows other HTML tags and event handlers.
   • CThe browser blocks script tags but allows event handlers.
   • DThe application encodes the payload only when it is stored, not when it is rendered.
   Reveal Solution Discussion Select an answer first