Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack GWAPT Practice Questions (Page 11)

Questions 51–54

1. 51foundation · easy

   What is the core characteristic of a Cross-Site Request Forgery (CSRF) attack?

   • AThe attacker injects malicious script into a trusted website to steal session cookies.
   • BThe attacker intercepts and modifies the victim's request in transit to change the action performed.
   • CThe attacker uses a cross-site scripting flaw to execute commands on the server with elevated privileges.
   • DThe attacker tricks the victim's browser into sending an unintended, authenticated request to a web application.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   What is the purpose of Content Security Policy (CSP) in mitigating XSS?

   • AIt prevents cookies from being sent over cross-site requests.
   • BIt encrypts all client-server communication to prevent injection.
   • CIt restricts the sources from which scripts can be loaded and executed.
   • DIt validates user input on the server side to remove malicious characters.
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   Which of the following is a secure coding practice to prevent client-side injection?

   • AUsing textContent instead of innerHTML when inserting user-controlled data into the DOM.
   • BDisabling JavaScript in the browser.
   • CUsing eval() to process user input for faster execution.
   • DStoring all user input in global variables for easy access.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   What is a common goal of exploiting a DOM-based client-side injection vulnerability?

   • ATo gain root access to the server operating system.
   • BTo encrypt the database and demand a ransom.
   • CTo manipulate the DOM and alter the page's behavior or content.
   • DTo modify the server's firewall rules.
   Reveal Solution Discussion Select an answer first