Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack GWAPT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security engineer is reviewing a web application that uses a JavaScript framework. They notice that the application concatenates user input into a JavaScript string that is later evaluated by `eval()`. Which of the following best describes this vulnerability and its primary mitigation?

   • AServer-side injection; sanitize input with a WAF
   • BDOM clobbering; rename all global variables
   • CClient-side injection; avoid eval and use safe DOM APIs or framework bindings
   • DReflected XSS; encode output on the server
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How does a CSRF attack typically exploit session cookies?

   • AIt steals the cookie value and replays it from the attacker's machine.
   • BIt uses JavaScript to read the cookie and send it to the attacker's server.
   • CIt modifies the cookie's Domain attribute to make it valid for the attacker's domain.
   • DIt relies on the browser automatically sending the cookie with requests to the target domain.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A penetration tester is explaining CSRF to a client. The client asks why a simple image tag can be used to perform a CSRF attack. Which explanation is MOST accurate?

   • AThe image tag can execute JavaScript that steals the session cookie
   • BThe image tag can send POST requests to the server
   • CThe browser automatically sends cookies with the image request, and the server cannot distinguish it from a legitimate request
   • DThe image tag bypasses the SameSite cookie attribute
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How do modern JavaScript frameworks like React or Angular help prevent client-side injection?

   • AThey encrypt all data before rendering it in the browser.
   • BThey disable all user input on the client side.
   • CThey require developers to manually sanitize all input.
   • DThey automatically escape data bound to the DOM by default.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A penetration tester is assessing a web application that uses a JavaScript framework with automatic output encoding. The tester finds that the application uses `innerHTML` to render a user-controlled value in a specific feature. Which of the following is the most accurate assessment of the risk?

   • AThe risk is low because the framework encodes all data by default
   • BThe risk is negligible because the value is user-controlled but not stored
   • CThe risk is moderate because innerHTML only allows HTML, not JavaScript
   • DThe risk is high because innerHTML bypasses the framework's automatic encoding
   Reveal Solution Discussion Select an answer first