Lecture 14: Cross Site Scripting attacks

Is web browsing stateful or stateless?

• Stateful

• Stateless

• Both

• All answers are valid

What's the main purpose of a cookie?

• To sniff user traffic in order to authenticate the user on a website

• To verify the version of the browser the user is using to access a website

• To enable web servers to store stateful information on the user's device or to track the user's browsing activity

• All answers are correct

Which header can we use to ensure a cookie can only be accessed using HTTP or HTTPs but not using javascript?

• Secure cookie

• HttpOnly cookie

• Persistent cookie

• Third party cookie

Which are the three main types of XSS attacks?

• reflected, redirected, persistent

• reflected, csrf , persistent

• injected, persistent and reflected

• persistent, reflected and DOM based

How can XSS attacks be prevented?

• Blocking the execution of local website javascript content

• Filtering input on arrival and encoding output

• Using appropriate response headers and Content Security Policies

• All answers are correct.

What kind of attack did Samy Kamkar triggered in myspace?

• Reflected XSS

• SQLi

• Stored XSS

• CSRF

What is the different between stateful and stateless apps?

• Stateless apps require to store the users session on the server, while stateful apps don't require it

• Stateful apps require to store the users session on the server, while stateless apps don't require it

• Stateful apps uses signed JWT tokens that are stored on the client side, while stateless apps use cookies

• Stateless apps uses signed JWT tokens that are stored on the client side, while stateful apps use cookies

How can CSRF attacks be prevented?

• Using a referer header

• Using a CSRF token

• Using a javascript signed cookie

• All of the answers are correct