NEW
Font size
WorksheetsWeb Enum and XSS
Total questions: 28
Worksheet time: 14mins
What is the primary role of a web server?
To store website code only
To process HTTP requests and serve web pages
To handle front-end design
To generate random website traffic
Which component of a website handles user interaction?
Web Server
Back-End
Database
Front-End
What protocol is primarily used to transfer web pages?
FTP
SSH
HTTP
SMTP
What happens when you enter a URL in a browser?
The browser sends a request to the DNS server to resolve the domain
The browser directly contacts the website's database
The browser creates a local copy of the website
The browser executes JavaScript first
What type of website component is MySQL?
Front-End
Web Server
Database
Web Framework
Which of the following is NOT a back-end programming language?
PHP
Python
JavaScript
HTML
What is the main purpose of a client in a web application?
To process server requests
To request and use resources from a server
To store website data permanently
To manage database storage
Apache and Nginx are examples of:
Web Browsers
Web Servers
Databases
Back-End frameworks
Which language is commonly used for front-end development?
Python
PHP
JavaScript
MySQL
What is the purpose of the `robots.txt` file?
To store website passwords
To block unauthorized users
To control search engine crawling
To log user activities
How can you view the source code of a webpage?
Open Developer Tools and go to the Elements tab
Right-click on the page and select "View Page Source"
Both a & b
You cannot view source code
Which of the following tools is used for directory brute forcing?
Hydra
Gobuster
Wireshark
Netcat
What does directory brute-forcing help find?
Open ports
Hidden or unlisted directories
SQL vulnerabilities
Web server versions
What is the correct command to use `gobuster` for directory enumeration?
`gobuster scan -u http://example.com`
`gobuster dir -u http://example.com -w /path/to/wordlist.txt -x php -t 100`
`gobuster find -u example.com`
`gobuster brute -u example.com`
Where can you commonly find sensitive information left exposed on a website?
robots.txt
Page source code
Configuration files
All of the above
What should you check first when performing website enumeration?
Database tables
Open source intelligence (OSINT)
robots.txt, source code, and directory brute-forcing
Front-end design
What command will find subdomains using Gobuster?
`gobuster subdomain -u http://example.com -w /path/to/wordlist.txt`
`gobuster dns -d example.com -w /path/to/wordlist.txt`
`gobuster host -u example.com`
`gobuster fuzz -u example.com`
What is the purpose of viewing a webpage’s source code?
To modify the website's back-end
To analyze HTML, CSS, and JavaScript for vulnerabilities
To see the database content
To interact with server logs
What is Cross-Site Scripting (XSS)?
A SQL injection attack
A type of phishing attack
An attack where an attacker injects malicious scripts into webpages
A denial-of-service attack
Which of the following is NOT an XSS type?
Stored
Reflected
Blind
DOM-based
Which input would trigger an alert in a vulnerable website?
alert('XSS')
alert'XSS'
XSS
`XSS`
How can you mitigate XSS attacks?
Input validation
Encoding user input
Using Content Security Policy (CSP)
All of the above
Which security measure helps prevent XSS?
Using HTTPS
Escaping user input
Hiding the robots.txt file
Allowing JavaScript execution
What is a common real-world impact of XSS?
Data loss
Session hijacking
Website defacement
All of the above
Which header helps protect against XSS attacks?
`Content-Type`
`Content-Security-Policy`
`User-Agent`
`Accept-Language`
What is the main difference between Stored and Reflected XSS?
Stored XSS executes on the victim’s browser, while Reflected XSS is stored in the database
Reflected XSS requires user interaction, while Stored XSS is automatically executed
Stored XSS affects only admin users
Reflected XSS affects only databases
What payload would test for Reflected XSS?
`http://example.com/search?q=<script>alert(1)</script>`
`
`SELECT * FROM users WHERE name='admin'--`
`../etc/passwd`
Why should developers encode user input?
To make the website faster
To prevent injection attacks like XSS
To improve SEO
To make JavaScript execution faster
