Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack GWAPT Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A penetration tester is assessing a web application that uses a single-page application (SPA) framework. The tester finds that user input is reflected in the page's URL fragment (e.g., #/profile/<input>). The application's JavaScript reads the fragment and updates the DOM using innerHTML. Which type of XSS is this, and why is it difficult to detect with server-side scanning?

   • AStored XSS; the payload is stored in the URL fragment
   • BReflected XSS; the server reflects the payload in the response
   • CUniversal XSS; the payload can affect any origin
   • DDOM-based XSS; the payload is processed entirely in the browser and never sent to the server
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is a common XSS injection point in a web application?

   • AThe HTTP request method (GET vs POST)
   • BThe server's configuration file for database connection strings
   • CThe server's IP address
   • DUser-supplied data in a search field that is echoed back without encoding
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security engineer is reviewing a web application that uses a JavaScript library to parse user-supplied HTML. The engineer discovers that the library is vulnerable to DOM clobbering, allowing an attacker to overwrite a global variable used for authentication checks. The application also has a strict Content Security Policy that blocks inline scripts. Which exploitation technique would MOST likely succeed in this scenario?

   • AUse a DOM clobbering payload that overrides the authentication variable and then triggers a legitimate script that relies on it
   • BInject an inline script that directly modifies the authentication variable
   • CLoad an external script from an attacker-controlled domain
   • DUse an event handler like onerror to execute JavaScript
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A penetration tester is testing a web application that reflects user input in an HTML attribute value without encoding. Which of the following payloads would be most likely to demonstrate XSS in this context?

   • Aalert(1)
   • B<script>alert(1)</script>
   • C" onmouseover="alert(1)"
   • Djavascript:alert(1)
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which type of Cross-Site Scripting (XSS) occurs when the injected script is reflected immediately in the server's response and is not stored on the server?

   • AUniversal XSS
   • BStored XSS
   • CReflected XSS
   • DDOM-based XSS
   Reveal Solution Discussion Select an answer first