Web Application Security Quiz

What is the main difference between content spoofing and reflected XSS?

• Content spoofing is a subset of XSS, while reflected XSS involves submitting malicious javascript code in HTTP requests

• Content spoofing uses advanced javascript frameworks, while reflected XSS considers the types of input in HTTP requests

• Content spoofing involves running attack-driven code in the client browser, while reflected XSS hides legitimate page content with absolutely positioned elements

• Content spoofing allows users to change a portion of the URL to modify content directly, while reflected XSS involves tampering with HTTP requests

What is the first line of defense for every web application against XSS?

• Html validation and sanitisation

• Secure JSON patterns

• Contextual output encoding

• Input validation

Which technique converts data to a form that is display-only and prevents the execution of javascript or rendering of HTML tags?

• Html validation and sanitisation

• Input validation

• Secure JSON patterns

• Contextual output encoding

When should you use HTML validation and sanitisation?

• When you want to allow all HTML without any restrictions

• When you want users to submit any HTML to your website

• When you want to allow only a limited subset of HTML and remove dangerous attributes

• When you want to eliminate all HTML from user submissions

What is the purpose of using secure JSON patterns in web applications?

• To deliver an HTML file without data and then populate it with JSON

• To populate HTML files with untrusted data directly

• To increase the attack surface by allowing untrusted data in JSON

• To prevent XSS attacks by parsing JSON data using the eval function

Which context requires different encoding methods depending on where untrusted data is inserted into the webpage?

• Javascript block content

• Javascript attribute context

• Attribute context

• HTML context

What is the recommended approach to parse JSON data in modern applications?

• Use JSON.parse to avoid untrusted data in JSON

• Use the eval function to prevent untrusted data from coming through

• Use HTML sanitisation to parse JSON data

• Use unpopulated HTML files for JSON data

Which defense strategy is ineffective against XSS attacks?

• Contextual output encoding

• Input validation

• Black-listed input validation

• Secure JSON patterns

What should be considered when deciding on a defense strategy against XSS?

• The color scheme of the website

• The types of input in HTTP requests and the locations where data will be included in the HTML document

• The number of images on the webpage

• The font size used in the CSS

Which defense mechanism involves converting data to a form that is display-only and prevents the execution of javascript or rendering of HTML tags?

• Secure JSON patterns

• Html validation and sanitisation

• Contextual output encoding

• Input validation