Web Application Security Quiz (Short Version)

Reviewed by Editorial Team
The ProProfs editorial team is comprised of experienced subject matter experts. They've collectively created over 10,000 quizzes and lessons, serving over 100 million users. Our team includes in-house content moderators and subject matter experts, as well as a global network of rigorously trained contributors. All adhere to our comprehensive editorial guidelines, ensuring the delivery of high-quality content.
Learn about Our Editorial Process
| By Searchlab
S
Searchlab
Community Contributor
Quizzes Created: 4 | Total Attempts: 4,836
| Attempts: 1,508 | Questions: 5
Please wait...
Question 1 / 5
0 %
0/100
Score 0/100
1. The most effective way of protecting against SQL injection is… 

Explanation

a] Blacklisting is a poor solution against SQL injection. It can be avoided in multiple ways, and can block valid user input if overused.
b] IDS can detect obvious SQL injection attempts, but it is possible for skilled attackers to avoid detection.
c] Whitelisting can be effective in general, but it overly restricts valid input. Many names have dashes and apostrophes in them, for example.
d] Use of prepared statements is generally accepted as the most effective way of protecting against SQL injection. The built-in escaping and validation will prohibit attackers from injecting a string into a numeric field, and quote data in string fields properly.
e] Adhering to the principle of least privilege is generally a good thing, but it only reduces the impact of a successful attack.

Submit
Please wait...
About This Quiz
Web Application Security Quiz (Short Version) - Quiz

This WEB APPLICATION SECURITY QUIZ assesses knowledge on preventing common web attacks such as SQL injection, XSS vulnerabilities, and ClickJacking. It is crucial for developers and security professionals... see moreto understand these mechanisms to safeguard web applications effectively. see less

2. Which is NOT true with respect to cross-site scripting (XSS) vulnerabilities?

Explanation

a] True; if there is a vulnerability in the JavaScript interpreter or in one of the browser plugins, an XSS attack can lead to client-side code execution.
b] True; an attacker can steal the user’s authentication data from cookies and use it to impersonate the user.
c] True; by definition, a reflected XSS vulnerability is triggered by the user actively following a link.
d] This is NOT true; there are browser plugins such as NoScript that can prevent running JavaScript from untrusted sites.
e] True, the payload may contain a HTTP request that is parametrized to exploit an XSS in another page on the same host. See the Samy MySpace worm for an example.

Submit
3. Which statement is true with respect to HTML5 security?

Explanation

A] False – the other domain needs to explicitly allow this
B] True
C] False – if the browser supports HTML5, the attacker can inject any kind of HTML5 tag into the page
D] False – it actually gives the attackers more opportunities for XSS attacks
E] False – Cross-site scripting attacks can read or modify Local Storage contents

Submit
4. If a web application includes a WYSIWYG editor, which of the approaches described below would NOT be appropriate for dealing with potential XSS in user input?

Explanation

a] Blacklisting is not a good approach, as there are many ways to circumvent and avoid such filters.
b] While this prevents cross-site scripting attacks, it also prevents users from submitting any kind of active content to the site.
c] This approach may be viable depending on the context, but it significantly restricts the scope of content users can submit – e.g. links.
d] This approach is generally accepted as the best compromise. However, the parameters of the special tags (e.g. URLs) must be validated in some way before conversion.
e] Depending on the language of the webapp, this may be a viable solution.

Submit
5. If the attacker can run JavaScript on the user's machine, he can expect to…

Explanation

a] True – the attacker can rewrite methods and change variables of other JavaScripts.
b] True – JavaScript clicks are equivalent to user clicks.
c] False – this is only possible if there is a bug in the browser that can be exploited through JavaScript.
d] False – a typical client-side breach cannot affect assets stored on the server.
e] True – JavaScript can relay keystrokes and e.g. send them to an iframe.

Submit
View My Results

Quiz Review Timeline (Updated): Aug 17, 2023 +

Our quizzes are rigorously reviewed, monitored and continuously updated by our expert board to maintain accuracy, relevance, and timeliness.

  • Current Version
  • Aug 17, 2023
    Quiz Edited by
    ProProfs Editorial Team
  • Sep 19, 2012
    Quiz Created by
    Searchlab
Cancel
  • All
    All (5)
  • Unanswered
    Unanswered ()
  • Answered
    Answered ()
The most effective way of protecting against SQL injection...
Which is NOT true with respect to cross-site scripting (XSS)...
Which statement is true with respect to HTML5 security?
If a web application includes a WYSIWYG editor, which of the...
If the attacker can run JavaScript on the user's machine, he can...
Alert!

Advertisement