Stored XSS WAHS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A penetration tester is testing a web application for Stored XSS. They submit a unique string like `zzxss123` in a comment field and then view the comment page. What is the purpose of this action?

   • ATo check if the comment field is vulnerable to command injection.
   • BTo determine if the application uses HTTPS.
   • CTo verify that the input is stored and reflected in the page output.
   • DTo test whether the server performs SQL injection filtering.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security analyst is evaluating the impact of a stored XSS vulnerability in a web application that uses JSON Web Tokens (JWT) for authentication. The JWT is stored in a cookie that is NOT marked HttpOnly. An attacker exploits the stored XSS to steal the JWT. What is the most significant consequence?

   • AThe attacker can modify the JWT payload to escalate privileges.
   • BThe attacker can replay the stolen JWT to impersonate the victim until the token expires.
   • CThe attacker can invalidate the JWT by sending a logout request.
   • DThe attacker can decrypt the JWT to reveal the user's password.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How does a Content Security Policy (CSP) help mitigate Stored XSS?

   • AIt restricts the sources from which scripts can be loaded, blocking inline scripts and untrusted origins.
   • BIt logs all user input for later forensic analysis.
   • CIt validates user input on the server side and rejects malicious payloads.
   • DIt encrypts the stored payload in the database.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is explaining a Stored XSS attack to a colleague. The attack involves an attacker posting a comment, the server saving it, and then a victim viewing the comment. Which step is the 'execution' step?

   • AThe server stores the comment in the database.
   • BThe attacker submits the malicious comment to the server.
   • CThe victim receives a phishing email with a link to the comment.
   • DThe victim's browser parses the HTML and runs the embedded script.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A development team is implementing a fix for a Stored XSS vulnerability in a user-generated content feature. The feature allows users to submit HTML that is rendered to other users. The team wants to allow safe HTML while preventing script execution. Which approach is MOST robust?

   • AUse JavaScript to sanitize the HTML in the browser before submission.
   • BUse a server-side HTML sanitizer library that removes scripts and event handlers, and encode output in the HTML context.
   • CAllow only a small set of HTML tags and attributes, and reject everything else.
   • DStore the HTML as base64 and decode it on the client side.
   Reveal Solution Discussion Select an answer first