How can an attacker use XSS to perform keylogging?

By sending a crafted HTTP request to the server that logs all user input.

By injecting JavaScript that attaches event listeners to capture keystrokes and sends them to an attacker-controlled server.

By exploiting a browser vulnerability to install a kernel-level keylogger.

A security architect is designing CSRF defenses for a large application that uses multiple subdomains (e.g., app.example.com, api.example.com). The application uses SameSite=Lax cookies and anti-CSRF tokens. However, a penetration test reveals that a subdomain with a stored XSS vulnerability can be used to read the anti-CSRF token from the main application. Which additional control would BEST mitigate this risk?

Use a custom header for CSRF protection instead of tokens

Use a separate cookie name and token for each subdomain

Set the SameSite attribute to Strict on all cookies

Implement a Content Security Policy that restricts script sources and disallows inline scripts

A team is hardening a legacy web application that has multiple XSS vulnerabilities. They want to implement a strong defense-in-depth strategy without rewriting the entire application. Which combination of controls would provide the most comprehensive protection?

Input validation using a blacklist of dangerous characters

Using a web application firewall to filter all requests

Disabling JavaScript in the browser via HTTP headers

Output encoding at all reflection points plus a strict Content Security Policy

A development team is using a modern JavaScript framework (e.g., React) to build a web application. They want to prevent client-side injection vulnerabilities. Which practice is MOST effective when using the framework?

Use a blacklist to remove all script tags from user input

Use the framework's built-in auto-escaping and avoid dangerous functions like innerHTML

Disable JavaScript in the browser to prevent client-side attacks

Rely on the framework's virtual DOM to sanitize all user input

GIAC Web Application Penetration Tester

Domain 5Objective 2

Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack GWAPT Practice Questions (Page 6)

Part of the Injection and Client-Side Attacks domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 8–14 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

11concepts

Questions 26–30

26foundation · easy
How can an attacker use XSS to perform keylogging?
Select an answer first
27expert · hard
A security architect is designing CSRF defenses for a large application that uses multiple subdomains (e.g., app.example.com, api.example.com). The application uses SameSite=Lax cookies and anti-CSRF tokens. However, a penetration test reveals that a subdomain with a stored XSS vulnerability can be used to read the anti-CSRF token from the main application. Which additional control would BEST mitigate this risk?
Select an answer first
28application · medium
A team is hardening a legacy web application that has multiple XSS vulnerabilities. They want to implement a strong defense-in-depth strategy without rewriting the entire application. Which combination of controls would provide the most comprehensive protection?
Select an answer first
29application · medium
A development team is using a modern JavaScript framework (e.g., React) to build a web application. They want to prevent client-side injection vulnerabilities. Which practice is MOST effective when using the framework?
Select an answer first
30foundation · easy
Which CSRF mitigation technique involves including a unique, unpredictable value in a hidden form field that the server validates?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.

Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack GWAPT Practice Questions (Page 6)

Questions 26–30

How can an attacker use XSS to perform keylogging?

A team is hardening a legacy web application that has multiple XSS vulnerabilities. They want to implement a strong defense-in-depth strategy without rewriting the entire application. Which combination of controls would provide the most comprehensive protection?

A development team is using a modern JavaScript framework (e.g., React) to build a web application. They want to prevent client-side injection vulnerabilities. Which practice is MOST effective when using the framework?

Which CSRF mitigation technique involves including a unique, unpredictable value in a hidden form field that the server validates?

Keep studying — Injection and Client-Side Attacks