NEW
Font size
WorksheetsCross-Site Scripting
Total questions: 10
Worksheet time: 2mins
Which is not an injection type of attack?
cross-site scripting
SQL injection
insecure direct object reference
LDAP injection
In cross-site scripting (XSS), malicious code executes on the client.
TRUE
FALSE
Which is NOT a type of XSS?
stored
injected
DOM-based
reflected
Reflected XSS is considered more damaging than stored XSS.
TRUE
FALSE
All but one are generally applied to user input to prevent XSS attacks.
sanitisation
filtering
encryption
escaping
What is typically stolen in a XSS attack?
hashed passwords for all users
unencrypted files
network traffic
session IDs from cookies
An attacker posts malicious XSS code in the comments section of a website. Where would this code typically run?
on the application server
on the database, when stored
on every browser that visits the page
on the database, when retrieved
Sanitising user input on the server side does NOT help prevent this type of XSS attack.
reflected
stored
DOM-based
none of the above
AJAX is generally used to...
send data using an encrypted connection
keep state between client and server
cache data within the browser
update content without reloading the full page
Which tool is used to download full webpages and their content?
spider
proxy
fuzzer
Zap
