Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack GWAPT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A web application has a persistent XSS vulnerability in a user profile field. The development team wants to implement a defense that blocks the execution of injected scripts while allowing legitimate HTML formatting. Which approach is MOST appropriate?

   • ASet the Content-Security-Policy header to 'unsafe-inline'
   • BEncode all user input as HTML entities before storing it
   • CUse a whitelist-based sanitizer that allows only safe HTML tags and attributes
   • DRemove all <script> tags from user input
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A user is logged into a banking website. While browsing a forum, the user clicks a link that submits a form to the banking website's transfer endpoint. The banking website uses session cookies but does not use anti-CSRF tokens. Which of the following best describes why this attack succeeds?

   • AThe banking website trusts the Referer header
   • BThe forum website has access to the banking session cookie
   • CThe user's browser has a vulnerability that allows cross-origin requests
   • DThe browser automatically includes the banking session cookie in the cross-site request
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is DOM clobbering?

   • AA type of denial-of-service attack that floods the DOM with excessive elements.
   • BA technique to bypass Content Security Policy by using DOM properties.
   • CA method to delete all DOM elements from a page using JavaScript.
   • DA technique where an attacker uses HTML elements with id or name attributes to overwrite JavaScript variables or DOM properties.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is investigating a stored XSS attack that defaced a website. The attacker injected a script that replaced the page's content with a fake login form. Which impact category does this attack represent?

   • ADefacement
   • BKeylogging
   • CSession hijacking
   • DData exfiltration
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a common CSRF delivery method that can trigger a request without user interaction beyond visiting a page?

   • AA DNS rebinding attack that changes the IP address of a domain
   • BA phishing email that asks the user to manually type a URL into the browser
   • CA JavaScript alert() popup that prompts the user to click OK
   • DAn HTML <img> tag pointing to a sensitive URL
   Reveal Solution Discussion Select an answer first