Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack GWAPT Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a potential impact of a successful XSS attack?

   • ADenial of service by consuming server CPU resources
   • BSession hijacking by stealing the victim's cookies
   • CDirect modification of server-side database records
   • DBypassing the application's firewall to access internal network resources
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A web application allows users to upload profile pictures. A penetration tester discovers that the application is vulnerable to CSRF on the profile-picture upload endpoint. Which of the following is the most effective mitigation that does not break the upload functionality?

   • ARequire a custom header such as X-Requested-With on the upload request
   • BSet the SameSite attribute to Strict on the session cookie
   • CCheck the Content-Type header of the upload request
   • DInclude a synchronizer token in the upload form and validate it on the server
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A tester is assessing a single-page application that uses a JavaScript framework. They find that the application uses `v-html` (Vue.js) to render user comments. Which of the following is the most likely impact of this finding?

   • AThe application will crash because v-html is deprecated
   • BAn attacker can inject arbitrary HTML and JavaScript that executes in other users' browsers
   • CThe application is vulnerable to CSRF because v-html disables anti-CSRF tokens
   • DThe application is vulnerable to SQL injection through the comment field
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A web application uses SameSite=Lax on its session cookie and anti-CSRF tokens on all state-changing forms. However, a penetration tester finds that the application has a stored XSS vulnerability on a subdomain that shares the parent domain. Which of the following is the most likely impact of this finding?

   • AThe XSS can be used to bypass SameSite=Lax and perform CSRF attacks on the main application
   • BThe anti-CSRF tokens prevent any impact from the XSS
   • CSameSite=Lax completely blocks all cross-site requests, so the XSS is harmless
   • DThe XSS is limited to the subdomain and cannot affect the main application
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A web application uses a client-side JavaScript function to read a URL parameter and set the innerHTML of a div element. A tester discovers that the parameter value is not sanitized. Which type of vulnerability is this, and what is the primary difference from a server-side injection?

   • AHTML injection; the attacker can modify the page but cannot execute JavaScript
   • BReflected XSS; the server reflects the payload in the response
   • CStored XSS; the payload is stored on the server and executed for other users
   • DDOM-based XSS; the vulnerability is in client-side code and the payload never reaches the server
   Reveal Solution Discussion Select an answer first