Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack GWAPT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is implementing CSRF defenses for a high-security application. They have deployed anti-CSRF tokens and SameSite=Strict cookies. However, a penetration test reveals that the application is still vulnerable to CSRF because the token is stored in a cookie that is sent with cross-site requests. Which additional control would BEST mitigate this issue?

   • AAdd a Content Security Policy that blocks all cross-origin requests
   • BUse a double-submit cookie pattern where the token is in both a cookie and a request parameter
   • CStore the anti-CSRF token in a custom header instead of a cookie
   • DSet the SameSite attribute to Lax instead of Strict
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security analyst is reviewing a web application that uses a JavaScript framework with automatic output encoding. The analyst discovers that the framework's encoding is bypassed when user input is used in a specific context, such as a JavaScript template literal. Which action would BEST address this vulnerability?

   • AUse a blacklist to remove all JavaScript keywords from user input
   • BAdd a Content Security Policy that blocks all inline scripts
   • CUse context-specific encoding for the JavaScript template literal context
   • DDisable the framework's automatic encoding and rely on manual sanitization
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following payloads is an example of an XSS payload that uses an HTML event handler?

   • A<!-- alert(1) -->
   • B<img src=x onerror=alert(1)>
   • C<script>alert(1)</script>
   • Djavascript:alert(1)
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A development team is migrating a legacy web application to a modern framework. The legacy application has numerous client-side injection vulnerabilities. The team wants to minimize the risk while preserving existing functionality. Which approach is MOST effective?

   • AKeep the legacy code but add a web application firewall (WAF) to filter malicious payloads
   • BAdd a Content Security Policy that blocks all inline scripts and restricts external sources
   • CUse a client-side sanitizer library on all user input
   • DRefactor the application to use the framework's safe rendering methods and avoid dangerous APIs
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is the most effective defense against XSS when user input is reflected in an HTML context?

   • ASetting the HttpOnly flag on cookies
   • BUsing HTTPS to encrypt the traffic
   • COutput encoding of user input before it is placed in the response
   • DUsing a web application firewall (WAF) to block suspicious requests
   Reveal Solution Discussion Select an answer first