Cross Origin Policy Attacks and Mitigation GWEB Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is investigating a potential data leak. A user visits a malicious page that uses JavaScript to load an image from https://bank.example.com/account-balance. The image endpoint returns a 200 OK if the balance is over $10,000 and a 404 otherwise. The malicious page uses the image's onload/onerror events to determine the balance. Which statement best describes this attack?

   • AThis is a DNS rebinding attack that bypasses the same-origin policy.
   • BThis is a cross-origin information leak using the same-origin policy's allowance for image loading.
   • CThis is a CSRF attack that changes the user's account balance.
   • DThis is a CORS misconfiguration that allows the malicious page to read the image data.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company operates a legacy web application that uses cookies for authentication and has no CSRF protection. The application is being modernized and the team wants to add CSRF defenses without breaking existing functionality. The application supports both form submissions and AJAX requests. Which combination of controls provides the most robust defense?

   • ADisable CORS and use JSONP for all requests.
   • BSet SameSite=Lax on the session cookie and add anti-CSRF tokens to all state-changing forms and AJAX requests.
   • CUse a custom header on all requests and validate it on the server.
   • DSet SameSite=None on the session cookie and rely on Origin header validation.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A legacy web application uses cookies for authentication and has many state-changing endpoints. The team wants to add CSRF protection without breaking existing functionality. Some users access the application through a reverse proxy that strips the Origin header. Which CSRF mitigation is most robust under these constraints?

   • ASet SameSite=Strict on the session cookie.
   • BValidate the Origin header on all requests.
   • CUse a synchronizer token stored in the session and validated on all state-changing requests.
   • DUse a double-submit cookie with a random value.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A user is logged into a social media site. While browsing a forum, a malicious post includes an image tag that points to the social media site's 'change email' endpoint. The browser requests the image, sending the user's session cookie. What is the primary reason this attack succeeds?

   • AThe social media site uses a wildcard CORS policy.
   • BThe image tag bypasses the same-origin policy entirely.
   • CThe browser automatically attaches the session cookie to the cross-origin request.
   • DThe same-origin policy does not apply to image requests.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is reviewing a web application that uses JSONP endpoints to support legacy integrations. They find that the application also uses cookies for authentication. Which attack is most likely to succeed due to the JSONP endpoint?

   • ADNS rebinding that makes the JSONP request go to an internal server.
   • BCross-site request forgery that triggers a state change via a JSONP GET request.
   • CCross-origin resource sharing that allows any origin to read JSONP responses.
   • DSame-origin policy bypass that allows reading the JSONP response without a callback.
   Reveal Solution Discussion Select an answer first