Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack GWAPT Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An online banking application uses a session cookie with no SameSite attribute and has anti-CSRF tokens on all forms. A penetration tester finds that the token is predictable because it is derived from the session ID using a reversible algorithm. Which attack would be most feasible for an attacker to exploit this weakness?

   • AUse a stored XSS payload to steal the token from the page
   • BCraft a cross-site form that submits a state-changing request with a guessed token
   • CPerform a session fixation attack by setting the session cookie
   • DLaunch a brute-force attack on the session ID itself
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A tester discovers a stored XSS vulnerability in a forum application. The application uses HttpOnly cookies for session management. Which of the following is the most significant impact the tester can demonstrate?

   • APerforming actions on behalf of the victim by using the XSS to make authenticated requests
   • BStealing the session cookie via document.cookie
   • CReading the victim's local files
   • DPerforming a denial-of-service attack on the server
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which of the following is a common client-side injection variant?

   • ACommand injection via a shell metacharacter
   • BSQL injection via a UNION query
   • CJavaScript injection via an unsafe eval() call
   • DXML injection via an external entity
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A web application uses SameSite=Strict cookies to prevent CSRF. However, after deployment, users report that they are logged out when clicking links from external sites, and some legitimate cross-site workflows break. The security team wants to maintain strong CSRF protection while improving usability. Which approach should they implement?

   • ARemove SameSite and rely on the browser's built-in CSRF protection
   • BKeep SameSite=Strict and add a custom header to all GET requests
   • CSet the cookie to SameSite=None with Secure and rely on CORS policies
   • DChange the cookie to SameSite=Lax and add anti-CSRF tokens to all state-changing requests
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A web application uses session cookies without the SameSite attribute and relies solely on a hidden anti-CSRF token in forms. During a penetration test, you discover that the token is also exposed in a URL parameter on a page that allows user-generated content. Which additional control would most effectively mitigate CSRF while preserving the application's current functionality?

   • AAdd a custom header requirement to all state-changing requests
   • BSet the SameSite attribute to Lax on session cookies
   • CSwitch the anti-CSRF token from hidden form fields to double-submit cookies
   • DImplement a strict Content Security Policy that disallows inline scripts
   Reveal Solution Discussion Select an answer first