Stored XSS WAHS Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Why is Stored XSS often considered more dangerous than Reflected XSS?

   • ABecause it bypasses all web application firewalls and cannot be mitigated.
   • BBecause it requires the attacker to trick the victim into clicking a specially crafted link.
   • CBecause it can only be exploited by authenticated administrators, making it harder to detect.
   • DBecause the payload is stored on the server and executes automatically for every user who views the affected page.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A web developer is testing a message board for stored XSS. The developer submits a comment containing the payload <img src=x onerror=alert(1)> and then views the comment in a different browser. The alert does not fire. What is the most likely reason?

   • AThe browser is blocking all JavaScript by default.
   • BThe application is encoding the payload when rendering the comment.
   • CThe payload is being executed only in the developer's original browser.
   • DThe payload is not being stored in the database.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company's public-facing website has a Stored XSS vulnerability in its blog comments. The company is subject to data protection regulations. An attacker exploits the vulnerability to steal session cookies of users. Which consequence is MOST directly related to regulatory compliance?

   • AThe company's web server crashes, causing downtime.
   • BThe attacker gains access to the server's operating system.
   • CThe attacker may access personal data of users, leading to a data breach notification obligation.
   • DThe website's performance degrades due to the malicious script.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst is assessing the risk of a stored XSS vulnerability in a corporate intranet portal. The portal is used by employees to share internal announcements. Which factor most increases the severity of this vulnerability?

   • AThe portal is accessible only to authenticated employees.
   • BThe portal has a small number of users.
   • CThe portal is hosted on a server with a public IP address.
   • DThe portal uses HTTPS for all communications.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A development team is fixing a Stored XSS vulnerability in a user comment feature. They want to prevent malicious scripts from executing while still allowing users to use basic HTML formatting like bold and italics. Which mitigation approach is MOST appropriate?

   • AImplement output encoding and a strict allowlist of HTML tags.
   • BRemove all HTML tags from user input before storing.
   • CUse a Content Security Policy that disables all inline scripts.
   • DEncode input only when storing it in the database.
   Reveal Solution Discussion Select an answer first