CSRF GWEB Practice Questions (Page 6)

Questions 26–27

1. 26foundation · easy

   Which of the following is a common method to detect CSRF vulnerabilities during security testing?

   • AChecking if the application sets the HttpOnly flag on session cookies.
   • BUsing a brute-force tool to guess the anti-CSRF token value.
   • CIntercepting a legitimate request and replaying it without a valid anti-CSRF token to see if the server accepts it.
   • DScanning the application for SQL injection vulnerabilities using automated tools.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a typical CSRF attack vector involving a forged POST request?

   • AAn attacker sends a crafted email with a link that, when clicked, triggers a POST request via JavaScript.
   • BAn attacker uses DNS rebinding to make the victim's browser send a POST request to the target application.
   • CAn attacker uses a link that the victim clicks to send a GET request to the target application.
   • DAn attacker creates a malicious web page with an auto-submitting form that posts to the target application.
   Reveal Solution Discussion Select an answer first