A web application reflects a user-supplied 'redirect' parameter in a Location header without sanitization. An attacker submits a value containing %0d%0aSet-Cookie: sessionid=attacker. The application responds with an additional Set-Cookie header. Which remediation would most directly prevent this HTTP header injection?

Set the HttpOnly flag on all cookies

URL-encode the redirect parameter before placing it in the header

Strip CR and LF characters from the redirect parameter before using it in the header

Use a redirect page that does not include the user input

What is the best defense against email header injection?

Blacklisting newline characters in user input.

Encoding user input in base64 before putting it in headers.

Disabling email headers in the application.

Using a secure email library that prevents header injection by validating input.

A development team is fixing an HTTP header injection vulnerability. They want to prevent CRLF injection while preserving the ability to set custom headers. Which mitigation is most effective?

Use a framework that automatically encodes headers

Encode user input with URL encoding before including it in headers

Sanitize user input by removing or rejecting CR and LF characters before including it in headers

Use a WAF to block requests containing `%0d%0a`

A developer is fixing a format string vulnerability in a C application. They want to prevent the vulnerability while maintaining the ability to print dynamic messages. Which coding practice is most effective?

Compile with `-Wformat` to enable compiler warnings

Use a fixed format string and pass user input as an argument to `printf`

Use `puts(user_input)` instead of `printf`

Escape all `%` characters in user input

A development team is fixing a NoSQL injection vulnerability in a MongoDB-backed application. They want to prevent operator injection while preserving the ability to search by username. Which approach is most effective?

Escape all special characters in the input

Use a WAF to block requests containing `$ne` or `$gt`

Use a blacklist of common operators like `$ne`, `$gt`, `$regex`

Validate that the input is a string and reject any input that starts with `$`

GIAC Certified Incident Handler

Domain 3Objective 3

Web Application Injection Attacks GCIH Practice Questions (Page 14)

Part of the Web Application Security domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 8–13 from this objective — we provide 80 practice questions to prepare you well beyond it. (estimate)

80questions here

16free pages

25concepts

25 Concepts in This Objective

SQL Injection Fundamentals
SQL Injection Attack Techniques
SQL Injection Mitigation
Command Injection
Command Injection Mitigation
LDAP Injection
LDAP Injection Mitigation
XML Injection
XML Injection Mitigation
NoSQL Injection
NoSQL Injection Mitigation
ORM Injection
ORM Injection Mitigation
XPath Injection
XPath Injection Mitigation
Buffer Overflow Injection
Buffer Overflow Mitigation
Format String Injection
Format String Mitigation
HTTP Header Injection
HTTP Header Injection Mitigation
Email Header Injection
Email Header Injection Mitigation
Injection Attack Detection and Testing
Injection Attack Defense in Depth

Questions 66–70

66application · medium
A web application reflects a user-supplied 'redirect' parameter in a Location header without sanitization. An attacker submits a value containing %0d%0aSet-Cookie: sessionid=attacker. The application responds with an additional Set-Cookie header. Which remediation would most directly prevent this HTTP header injection?
Select an answer first
67foundation · easy
What is the best defense against email header injection?
Select an answer first
68application · medium
A development team is fixing an HTTP header injection vulnerability. They want to prevent CRLF injection while preserving the ability to set custom headers. Which mitigation is most effective?
Select an answer first
69application · medium
A developer is fixing a format string vulnerability in a C application. They want to prevent the vulnerability while maintaining the ability to print dynamic messages. Which coding practice is most effective?
Select an answer first
70application · medium
A development team is fixing a NoSQL injection vulnerability in a MongoDB-backed application. They want to prevent operator injection while preserving the ability to search by username. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.