Web App Attack Quiz: SQLi, XSS & CSRF Decoded

1. Blind SQL injection occurs when the application does not display database error messages to the attacker. True or False?

True

False

2. What is the primary difference between SQLi and command injection attacks?

SQLi targets databases; command injection targets OS command execution

SQLi only affects frontend; command injection affects backend

SQLi requires authentication; command injection does not

SQLi uses GET requests; command injection uses POST

3. DOM-based XSS vulnerabilities occur when client-side JavaScript processes untrusted data unsafely. True or False?

True

False

4. Input sanitization removes dangerous characters from user input to prevent injection attacks. True or False?

True

False

5. Which HTTP method is most vulnerable to CSRF attacks?

POST and GET

PUT and DELETE only

HEAD requests

OPTIONS requests

6. A Web Application Firewall (WAF) can filter malicious SQL injection and XSS payloads before they reach the application. True or False?

True

False

7. The HttpOnly cookie flag prevents JavaScript from accessing cookies, reducing XSS impact. True or False?

True

False

8. Which technique helps detect SQLi attempts in real-time?

Web Application Firewall (WAF) rules

Disabling all database queries

Removing user input validation

Using only client-side validation

9. In a CSRF attack, the attacker typically needs the victim to be authenticated to the target website. True or False?

True

False

10. Content Security Policy (CSP) headers help mitigate XSS by restricting script sources. True or False?

True

False

11. What does SQL injection (SQLi) primarily exploit?

Improper input validation in database queries

Weak encryption algorithms

Outdated SSL certificates

Unpatched operating systems

12. What is the primary goal of a CSRF attack?

Force a user to perform unwanted actions on their account

Steal database credentials

Execute arbitrary code on the server

Intercept network traffic

13. Which XSS type executes in a victim's browser without the payload being stored on the server?

Reflected XSS

Stored XSS

DOM-based XSS

Persistent XSS

14. Parameterized queries (prepared statements) prevent SQL injection by separating code from data. True or False?

True

False

15. A successful SQLi attack can allow an attacker to read, modify, or delete database records. True or False?

True

False

16. Which token mechanism best prevents CSRF attacks?

Synchronizer token pattern (SameSite cookies)

Session ID in URL parameters

Basic authentication headers

IP whitelisting

17. CSRF attacks exploit the trust a website has in a user's browser. True or False?

True

False

18. What is the primary defense mechanism against XSS attacks?

Input validation and output encoding

Disabling JavaScript globally

Using HTTPS only

Implementing rate limiting

19. Reflected XSS attacks differ from stored XSS in that reflected XSS requires the victim to click a malicious link, while stored XSS persists in the database. True or False?

True

False

20. Which of the following is a common SQLi payload technique?

Using OR 1=1 to bypass authentication

Modifying HTTP headers

Injecting JavaScript code

Exploiting CORS misconfigurations

Web App Attack Quiz: SQLi, XSS & CSRF Decoded

1. Blind SQL injection occurs when the application does not display database error messages to the attacker. True or False?

2.

What first name or nickname would you like us to use?

2. What is the primary difference between SQLi and command injection attacks?

3. DOM-based XSS vulnerabilities occur when client-side JavaScript processes untrusted data unsafely. True or False?

4. Input sanitization removes dangerous characters from user input to prevent injection attacks. True or False?

5. Which HTTP method is most vulnerable to CSRF attacks?

6. A Web Application Firewall (WAF) can filter malicious SQL injection and XSS payloads before they reach the application. True or False?

7. The HttpOnly cookie flag prevents JavaScript from accessing cookies, reducing XSS impact. True or False?

8. Which technique helps detect SQLi attempts in real-time?

9. In a CSRF attack, the attacker typically needs the victim to be authenticated to the target website. True or False?

10. Content Security Policy (CSP) headers help mitigate XSS by restricting script sources. True or False?

11. What does SQL injection (SQLi) primarily exploit?

12. What is the primary goal of a CSRF attack?

13. Which XSS type executes in a victim's browser without the payload being stored on the server?

14. Parameterized queries (prepared statements) prevent SQL injection by separating code from data. True or False?

15. A successful SQLi attack can allow an attacker to read, modify, or delete database records. True or False?

16. Which token mechanism best prevents CSRF attacks?

17. CSRF attacks exploit the trust a website has in a user's browser. True or False?

18. What is the primary defense mechanism against XSS attacks?

19. Reflected XSS attacks differ from stored XSS in that reflected XSS requires the victim to click a malicious link, while stored XSS persists in the database. True or False?

20. Which of the following is a common SQLi payload technique?