Web and application pentesting: understanding vulnerabilities Quiz

Quiz: client-side flaws

Pass mark: 70%. You can retry as many times as you need.

1 A search page repeats your query in its heading, and your harmless markup test comes back rendered (italic text) instead of displayed literally. What does this show? Single answer The application is protected by a Content Security Policy The page is vulnerable to SQL injection Input is reflected without encoding, which indicates a reflected XSS The session cookie is missing the Secure attribute

2 Which statements correctly describe stored XSS and DOM-based XSS? (several answers) Multiple answers possible Stored XSS can affect every user who views the infected page, without them clicking a crafted link DOM-based XSS always requires a database DOM-based XSS involves a source (such as the URL fragment) and a sink (such as innerHTML) A DOM-based flaw may never appear in the server logs

3 Which fix best addresses a DOM-based XSS where a script inserts a URL fragment with innerHTML? Single answer Remove a few dangerous words from the fragment Encode the output on the server Hide the fragment from the browser history Insert the value with textContent, or sanitise it with a maintained library

4 Which conditions are needed for a classic CSRF attack to work? (several answers) Multiple answers possible A state-changing action, such as changing an email address A session that the browser sends automatically, for example through a cookie The attacker must read the server’s response Request parameters that are predictable, with no secret token

5 Which header combination best protects a sensitive page against clickjacking? Single answer Content-Security-Policy with frame-ancestors, plus X-Frame-Options Strict-Transport-Security alone X-Content-Type-Options and Referrer-Policy Permissions-Policy for the camera