Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack GWAPT Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A developer wrote a search page that reads the `q` parameter and writes it into `document.getElementById('results').innerHTML` after a client-side fetch. A tester discovers that submitting `?q=<img src=x onerror=alert(1)>` triggers an alert. The application's server-side API correctly encodes all responses. Which of the following is the most effective remediation?

   • AEncode the input on the server before sending it to the client
   • BUse textContent instead of innerHTML to insert the search results
   • CAdd a Content Security Policy that blocks inline event handlers
   • DValidate the `q` parameter to allow only alphanumeric characters
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A security team is reviewing a legacy web application that uses a global JavaScript variable named `user` to store the current user's role. An attacker discovers that they can inject an HTML element with `id="user"` into the page. Which of the following best describes the vulnerability and its most effective mitigation?

   • AJavaScript injection; disable eval in the application
   • BCSRF; add an anti-CSRF token to the page
   • CReflected XSS; encode the user role on the server
   • DDOM clobbering; use a scoped variable or a closure instead of a global variable
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A development team is using a JavaScript framework that automatically escapes data in templates. They need to render a user-controlled rich-text field that allows basic formatting (bold, italic, links). Which of the following approaches is the most secure way to implement this feature?

   • ARender the rich text using innerHTML after escaping all HTML characters
   • BUse a sanitization library to allowlist allowed HTML tags and attributes before rendering
   • CUse the framework's default escaping and display the raw HTML as plain text
   • DUse a blacklist to remove script tags and event handlers
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A penetration tester discovers a stored XSS vulnerability in a web application that uses HttpOnly and Secure cookies. The application also has a strict Content Security Policy that blocks inline scripts and eval. Which of the following is the most likely impact the tester can demonstrate?

   • AThe XSS can steal the session cookie by using a script from an allowed domain
   • BThe XSS can still make authenticated requests to perform actions as the victim
   • CThe XSS is completely mitigated by the combination of HttpOnly and CSP
   • DThe XSS can only deface the page and cannot perform any other actions
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   How can an attacker exploit a client-side injection vulnerability to steal data?

   • ABy injecting JavaScript that reads sensitive information from the DOM and sends it to an attacker-controlled server.
   • BBy injecting SQL commands that query the database directly.
   • CBy injecting network packets to intercept traffic.
   • DBy injecting shell commands that read files from the server.
   Reveal Solution Discussion Select an answer first