Quiz
Analyse 9 week 4
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (20)
1Cross-site Scripting may be used to hijack cookie-based sessions.
- ATrue
- BFalse
2An attacker used scripts to change information on a page as it is displayed to the bank clerk for manual inspection. This attack can be successful because of _______________.
- Avulnerability in the bank database
- Binappropriate output handling in web application
- Cnot escaping shell meta-characters
- Dcareless manual inspection by clerk
3Suppose a web application allows the attacker to inject the attached script into the HTML sending to the user's browser, and the script is allowed to be executed by the browser.
What is correct about the web application?
<script>
for (q = 0; q < 10000; q++)
window.open("http://www.google.com");
</script>- AWeb application is not properly handling the output.
- BWeb application is not properly hiding the HTML.
- CWeb application is not properly handling the shell command.
- DWeb application is not properly handling the input.
4To avoid Shell Command Injection, prefixing the metacharacters with a backslash is an approach to escape them in the data string.
- ATrue
- BFalse
5For HTML Cross-site Scripting, the most appropriate time to deal with data passing problem is whenever our application _______________ .
- Agenerates some input
- Bgenerates some output
- Cpasses data to the database
- Dsends HTTP requests
6What is the first step in simplest possible session hijacking using Cross-site Scripting?
- AAttacker injects script on the server and waits for a victim.
- BServer passes a session cookie and the attacker’s script to a visitor.
- CScript runs in the victim’s browser, and passes the session cookie to the attacker
- DAttacker passes the stolen cookie, making the server think he is the victim.
7Cross-site Scripting is a _______________.
- Anetwork layer problem
- Binput validation problem
- Cshell problem
- Dmetacharacter problem
8What is the attached image?
HTTP/1.1 200 OK
Date: Sun, 07 Dec 2003 21:16:12 GMT
Server: Apache/1.3.27 (Unix) PHP/4.3.2
Last-Modified: Wed, 20 Aug 2003 20:31:11 GMT
Content-Length: 84
Connection: close
Content-Type: text/html
<html>
<head><title>Test</title></head>
<body>
<p>Hello, world!</p>
</body>
</html>- AHTTP Request
- BHTTP Response
- CAttacker's Script for Session Hijacking
- DNone of the above answers
9"The attacker needs the unique session ID cookie of the victim to impersonate him/her."
What is the described attack?- APacket Sniffing
- BSQL Injection
- CDenial-of-Service
- DSession Hijacking
10A good reason for not filtering HTML at input time, as a countermeasure against XSS attacks is because ________________.
- Adata from other external source should not be HTML encoded.
- Bany non-HTML part of the application that uses the same database will have to remove the HTML encoding.
- CHTML encoding does not expand data strings.
- DAll the above reasons are correct.
11What is the main task of injected script by attacker in XSS-based session hijacking?
- Ato pick up the cookie containing the session ID, and passes the cookie to the attacker’s computer.
- Bto change information on the page as it is displayed to the victim.
- Cto generate web a page that contains URLs and forms inviting the user to do something.
- DAll the above answers.
12What type of attack can be defined by this:
"the HTML parser in the web browser interprets pieces of HTML that the web application programmer
did not intend to send."- ACross-site Scripting
- BPacket Sniffing
- CSQL Injection
- DSocial Engineering
13As _____________ are available to a script, Cross-site Scripting may be used to hijack cookie-based sessions.
- Acookies
- Bsessions
- CHTTP requests
- DShell commands
14The secrecy of the session ID is the only mechanism that gives real protection against session hijacking.
- ATrue
- BFalse
15The only safe filtering of the output is to HTML encode certain characters, and at the same time to state what character set the encoding has been done for.
- ATrue
- BFalse
16Which of the following statements is incorrect in XSS attack?
- AThe intention is often to steal session information, and thus be able to contact the site on behalf of the victim.
- BIt attacks the network transport rather than the application or the client.
- CIt is about tricking a web server into presenting malicious HTML, typically script code, to a user.
- DIt generally attacks the user of the web application, not the application itself.
17In a cross-site scripting session hijacking, If the attacker connects directly to the web site, he can get victim's unique cookie, only if the victim is logged in.
- ATrue
- BFalse
18For what type of attack, the attached script can be used?
<script>
function foo() {
document.body.innerHTML.replace(/1234.56.78901/gi, "9876.54.32109");
}
window.onload=foo;
</script>- ASession Hijacking
- BSQL Injection
- CText Modification
- DAll the above attacks
19Even though different shells have different metacharacters, but they all use the metacharacters in the same way.
- ATrue
- BFalse
20To hijack a session without a valid session ID, the server software must have some serious bugs in it.
- ATrue
- BFalse
Information
- Description
- Learning Technology Quiz on Analyse 9 week 4, created by Joost Stam on 07/04/2019.
- Author
- Joost Stam
- Language
- English
- Views
- 28
- Tags
- Rating
- No ratings yet Rate this quiz