Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack GWAPT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A penetration tester is analyzing a web application that uses a JavaScript framework. The tester finds that user input is reflected in a JavaScript variable inside a `<script>` block. Which of the following payloads would be most likely to execute in this context?

   • Ajavascript:alert(1)
   • B';alert(1);//
   • C" onmouseover="alert(1)"
   • D<script>alert(1)</script>
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of a client-side injection attack?

   • ASQL injection into a login form
   • BHTML injection that alters the page content displayed to the user
   • CLDAP injection into an authentication backend
   • DCommand injection into a web shell
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security engineer is evaluating CSRF defenses for a web application that uses JSON-based APIs. The application currently uses a custom header (X-Requested-With) to distinguish legitimate requests. Which of the following is the most important limitation of this approach?

   • ACustom headers are only effective for POST requests, not GET requests
   • BCustom headers are not sent by browsers on cross-origin requests, so they are a strong defense
   • CCustom headers can be spoofed by cross-origin requests using the fetch API with CORS misconfiguration
   • DCustom headers are stored in the session cookie and can be stolen by XSS
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A support portal displays a user's search query in the page title and in a search-results heading. A tester submits the string `</title><script>alert(document.cookie)</script>` and observes the alert firing. The application does not use any client-side frameworks. Which classification best describes this vulnerability, and what is the most appropriate immediate fix?

   • AReflected XSS; apply context-aware output encoding for HTML and attribute contexts
   • BStored XSS; sanitize all user input with a blacklist of dangerous tags
   • CReflected XSS; disable JavaScript in the browser for the portal
   • DDOM-based XSS; move the search query to a JavaScript variable and use innerHTML
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A development team is using a modern JavaScript framework (React) to build a web application. They want to prevent client-side injection vulnerabilities. Which of the following practices is most effective?

   • AUse a blacklist to filter out script tags from user input
   • BDisable JavaScript in the browser for the application
   • CUse innerHTML for all dynamic content to improve performance
   • DAvoid using dangerouslySetInnerHTML and rely on React's default escaping
   Reveal Solution Discussion Select an answer first