I85PREP
⌘ K
OSWA study materials
OSWA study resources

OSWA practice questions

One question at a time. Build your OSWA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web application reconnaissance and enumeration

During web application reconnaissance, which HTTP response header most directly reveals the specific server software and version handling the request?

  1. Content-Type
  2. Accept-Ranges
  3. Server Correct answer.
  4. Cache-Control

Explanation

The Server header is emitted by the web server to identify its product and often its version, which helps a tester fingerprint the backend. Content-Type, Accept-Ranges, and Cache-Control describe the response body and caching behavior, not the server product identity.

Question 2Web application reconnaissance and enumeration

A tester wants to enumerate directories on a target but the server returns HTTP 200 with a generic 'welcome' page for every nonexistent path. Which approach best reduces false positives?

  1. Filter results by comparing response body length and content hash against the baseline page Correct answer.
  2. Increase the number of threads until the scan finishes faster
  3. Disable redirect following and treat every 3xx as a confirmed directory
  4. Switch to sending HEAD requests only and trust every 200 response

Explanation

When the server returns a soft 404 with a constant page, the reliable signal is the deviation of body size or content hash from that baseline. Comparing against the known catch-all response lets the tester discard noise and keep genuine hits.

Question 3Web application reconnaissance and enumeration

Which DNS record type should a tester query to discover the mail exchangers that reveal a target organization's email infrastructure?

  1. CNAME
  2. A
  3. TXT
  4. MX Correct answer.

Explanation

MX records list the mail exchanger hosts responsible for accepting email for a domain, directly exposing email infrastructure. A and CNAME records map names to addresses or aliases, and TXT records carry arbitrary text such as SPF data.

Question 4Web application reconnaissance and enumeration

During subdomain enumeration, a wildcard DNS entry causes every random name to resolve. Which technique best identifies genuine subdomains despite the wildcard?

  1. Send the queries over TCP instead of UDP
  2. Resolve several random nonexistent names to learn the wildcard response and exclude hosts matching it Correct answer.
  3. Query only the apex domain and assume no subdomains exist
  4. Rely on reverse DNS lookups of the apex IP address

Explanation

A wildcard answers any name, so the tester must first characterize the wildcard response using random labels and then exclude results that match it. Only resolutions that differ from the wildcard pattern are likely genuine subdomains.

Question 5Web application reconnaissance and enumeration

A tester inspects a JavaScript file served by the application and finds API endpoint paths hardcoded in it. What reconnaissance value does this provide?

  1. It exposes hidden API routes that may not be linked from the visible interface Correct answer.
  2. It confirms the database engine version
  3. It reveals the server's private signing keys
  4. It proves the application is vulnerable to cross-site scripting

Explanation

Client-side JavaScript often references API paths that are not reachable through normal navigation, giving testers additional attack surface to enumerate. Finding these strings does not by itself prove any vulnerability or disclose secrets like keys.

Question 6Web application reconnaissance and enumeration

Which tool is specifically designed for content discovery by brute-forcing paths and files against a web server using a wordlist?

  1. sqlmap
  2. John the Ripper
  3. Wireshark
  4. ffuf Correct answer.

Explanation

ffuf is a fast web fuzzer commonly used to brute-force directories, files, and parameters using wordlists. Wireshark captures packets, sqlmap automates SQL injection, and John the Ripper cracks password hashes.

Question 7Web application reconnaissance and enumeration

When performing banner grabbing against a web service, why is sending a malformed or empty HTTP request sometimes useful?

  1. It can elicit error responses that disclose server software and version details Correct answer.
  2. It forces the server to disable its firewall
  3. It guarantees the server will return its configuration file
  4. It encrypts the response so it cannot be logged

Explanation

Malformed or empty requests often trigger error pages or default responses that leak software names, versions, and stack details useful for fingerprinting. Such requests cannot force configuration disclosure, firewall changes, or encryption.

Question 8Web application reconnaissance and enumeration

Which file, if publicly accessible, most commonly leaks a web application's directory structure and configuration during reconnaissance?

  1. logo.png
  2. robots.txt Correct answer.
  3. favicon.ico
  4. style.css

Explanation

robots.txt frequently lists paths the owner wants excluded from crawlers, which often reveals administrative or sensitive directories. Static assets like icons, stylesheets, and images rarely disclose directory structure.

Question 9Web application reconnaissance and enumeration

A tester notices the target responds with a different HTTP status for existing versus nonexistent user IDs on an API endpoint. Which reconnaissance finding does this represent?

  1. A cross-site request forgery vulnerability
  2. A DNS zone transfer
  3. An enumeration vector through differential responses Correct answer.
  4. A TLS certificate mismatch

Explanation

When the server answers differently for valid and invalid identifiers, an attacker can enumerate valid accounts or resources by observing the difference. This is a response-differential enumeration issue, not CSRF, TLS, or DNS behavior.

Question 10Web application reconnaissance and enumeration

Which HTTP method is most appropriate for retrieving the headers of a resource without downloading its body during reconnaissance?

  1. DELETE
  2. PUT
  3. HEAD Correct answer.
  4. POST

Explanation

HEAD returns the same headers as GET but omits the response body, making it efficient for checking resource existence and metadata. POST, PUT, and DELETE are state-changing methods not suited to simple metadata retrieval.

Question 11Web application reconnaissance and enumeration

A tester wants to discover virtual hosts hosted on the same IP address as the target. Which request attribute must be varied to enumerate them?

  1. The Host header Correct answer.
  2. The Accept-Language header
  3. The Cookie header
  4. The User-Agent header

Explanation

Virtual host routing is determined by the Host header, so varying it while keeping the IP constant reveals distinct sites served by the same address. User-Agent, Accept-Language, and Cookie do not select the virtual host.

Question 12Web application reconnaissance and enumeration

Which record type, when misconfigured to allow transfers, lets a tester dump an entire DNS zone in one query?

  1. SRV
  2. CAA
  3. AXFR Correct answer.
  4. PTR

Explanation

AXFR is the zone transfer request that, if permitted, returns all records in a zone and can expose many hostnames at once. PTR maps addresses to names, SRV locates services, and CAA restricts certificate issuance.

Question 13Web application reconnaissance and enumeration

A tester finds that the application returns verbose stack traces containing framework and library versions when an invalid parameter is supplied. What is the primary reconnaissance benefit?

  1. It proves the database is externally reachable
  2. It reveals the physical location of the server
  3. It enables precise fingerprinting of the technology stack for targeted testing Correct answer.
  4. It confirms the application has no input validation

Explanation

Stack traces disclose framework, library, and version details that let a tester identify known issues relevant to that exact stack. They do not prove the absence of validation, external database reachability, or physical location.

Question 14Web application reconnaissance and enumeration

Which technique best maps the technologies a site uses, such as CMS, analytics, and JavaScript libraries, during passive reconnaissance?

  1. Sending crafted SQL injection payloads to the search form
  2. Attempting to brute-force the admin login
  3. Running a full port scan of all 65535 ports
  4. Reviewing page source and response headers for identifying signatures Correct answer.

Explanation

Technology fingerprinting during passive reconnaissance relies on signatures in HTML, headers, and asset paths that identify CMS platforms and libraries. Active attacks or full port scans are separate activities that do not map client-side technologies.

Question 15Web application reconnaissance and enumeration

During reconnaissance a tester obtains the target's TLS certificate. Besides the common name, which certificate field often reveals additional hostnames belonging to the organization?

  1. Subject Alternative Name Correct answer.
  2. Key Usage
  3. Signature Algorithm
  4. Serial Number

Explanation

The Subject Alternative Name extension lists all hostnames the certificate is valid for, frequently exposing related subdomains. Signature Algorithm, Serial Number, and Key Usage describe cryptographic properties, not hostnames.

Question 16Web application reconnaissance and enumeration

A tester uses search engine queries with operators like site: and inurl: to gather information about a target without directly touching its servers. What is this activity called?

  1. Active vulnerability scanning
  2. Privilege escalation
  3. Passive OSINT reconnaissance Correct answer.
  4. Fuzzing

Explanation

Using third-party search indexes to collect information without interacting with the target's infrastructure is passive OSINT reconnaissance. Active scanning, fuzzing, and privilege escalation all involve direct interaction with the target.

Question 17Web application reconnaissance and enumeration

Which response characteristic most reliably distinguishes a genuine directory from a soft-404 page when the server always returns 200?

  1. Whether the connection used HTTP/1.1 or HTTP/2
  2. The order in which the request headers were sent
  3. A consistent difference in response body length or content compared with the soft-404 baseline Correct answer.
  4. The presence of the word 'index' anywhere in the response

Explanation

When status codes cannot distinguish hits, comparing body length or content against the known soft-404 response is the dependable method. Text keywords, protocol version, and header ordering are unreliable indicators.

Question 18Web application reconnaissance and enumeration

A tester identifies that an application reflects a URL parameter inside a JavaScript context. Before deeper testing, what reconnaissance-oriented step best characterizes the input handling?

  1. Immediately launch a denial-of-service flood against the endpoint
  2. Report the finding without any verification
  3. Probe with benign marker strings to observe encoding and reflection behavior Correct answer.
  4. Assume the parameter is safe because it is numeric

Explanation

Sending benign markers lets the tester observe how the application encodes and reflects input, mapping the context for later analysis. Flooding the endpoint is destructive, and assuming safety or reporting unverified findings is poor practice.

Question 19Web application reconnaissance and enumeration

Which artifact commonly reveals the web framework in use when inspecting a rendered page's HTML source?

  1. The HTTP status code
  2. The Content-Length header
  3. The connection's TCP window size
  4. Comments and asset paths containing framework-specific names Correct answer.

Explanation

Framework-specific comments, script paths, and asset naming conventions in the HTML are strong fingerprints of the underlying framework. Status codes, content length, and TCP parameters do not identify frameworks.

Question 20Web application reconnaissance and enumeration

A tester wants to enumerate parameters accepted by a web endpoint that returns identical responses for unknown parameters. Which approach is most reasonable?

  1. Compare responses for a large set of candidate parameter names and flag those producing behavioral differences Correct answer.
  2. Assume parameters match the visible form fields exactly
  3. Disable cookies and retry the request
  4. Send only the request with no parameters and conclude none exist

Explanation

Hidden parameters can be discovered by testing many candidate names and looking for differences in response size, timing, or content. Sending no parameters, assuming only visible fields, or removing cookies will not reveal hidden inputs.

Question 21Web application reconnaissance and enumeration

Which of the following best describes the purpose of a wordlist in content discovery?

  1. It encrypts traffic between the tester and the server
  2. It supplies candidate names to request so the tester can identify existing paths Correct answer.
  3. It validates the target's TLS certificate chain
  4. It stores captured HTTP responses for later replay

Explanation

A wordlist provides the candidate directory and file names that the tool requests, and matches reveal existing content. It does not store responses, encrypt traffic, or validate certificates.

Question 22Web application reconnaissance and enumeration

A tester discovers that the target's web server exposes a status page listing internal hostnames and upstream services. What is the most appropriate reconnaissance conclusion?

  1. The page indicates the server lacks a TLS certificate
  2. The page confirms the database is unpatched
  3. The page proves remote code execution is possible
  4. The page leaks internal topology that can guide further enumeration Correct answer.

Explanation

A status page disclosing internal hostnames and upstream services reveals topology that helps direct later enumeration. It does not by itself prove code execution, certificate absence, or database patch level.

Question 23Web application reconnaissance and enumeration

When fingerprinting a web server, which behavior most strongly suggests the presence of a reverse proxy or load balancer in front of the origin?

  1. A redirect from HTTP to HTTPS
  2. An HTTP 404 response for a missing file
  3. A single static HTML page
  4. Inconsistent Server headers or differing responses across repeated requests Correct answer.

Explanation

Multiple backend systems behind a proxy often produce varying Server headers or subtly different responses across requests. A static page, a 404, or an HTTP-to-HTTPS redirect are common and do not indicate a proxy.

Question 24Web application reconnaissance and enumeration

Which source is most useful for passive enumeration of a target's historical URLs and forgotten endpoints without sending requests to the target?

  1. A packet sniffer on the tester's own host
  2. A local port scanner
  3. A public web archive that indexes previously crawled pages Correct answer.
  4. A password cracking tool

Explanation

Web archives store historical snapshots and URL indexes, letting a tester find old endpoints without touching the target. Port scanners, crackers, and local sniffers do not provide historical URL data.

Question 25Web application reconnaissance and enumeration

A tester observes that requesting a nonexistent path returns a 302 redirect to the site's homepage while a real directory returns 200. How should this behavior be interpreted during enumeration?

  1. The 302 proves the path is vulnerable to open redirect
  2. The redirect indicates the server is offline
  3. Every 302 confirms a hidden administrative panel
  4. The redirect is a catch-all and should be excluded from results Correct answer.

Explanation

A redirect to the homepage for arbitrary nonexistent paths is a catch-all behavior and should be filtered out to avoid false positives. It does not confirm an admin panel, server downtime, or an open redirect vulnerability.

Question 26Cross-Site Scripting (XSS)

When a web application reflects user-supplied input directly into the HTML response without encoding, which class of cross-site scripting vulnerability is present?

  1. Stored XSS
  2. DOM-based XSS
  3. Mutation XSS
  4. Reflected XSS Correct answer.

Explanation

Reflected XSS occurs when the server immediately echoes request data into the response page without proper output encoding. The payload is not persisted; it executes only for the victim who submits the crafted request. Stored and DOM-based variants involve persistence or client-side sinks respectively.

Question 27Cross-Site Scripting (XSS)

Which HTTP response header, when set to a restrictive policy, is the primary defense against cross-site scripting by controlling which script sources the browser may execute?

  1. Content-Security-Policy Correct answer.
  2. Strict-Transport-Security
  3. X-Frame-Options
  4. Referrer-Policy

Explanation

Content-Security-Policy lets the server declare approved script sources, blocking inline and unauthorized external scripts. X-Frame-Options addresses clickjacking, HSTS enforces HTTPS, and Referrer-Policy controls referrer leakage. CSP is the standard browser-enforced mitigation for XSS.

Question 28Cross-Site Scripting (XSS)

A developer needs to safely insert untrusted text into an HTML element's content. Which encoding context applies?

  1. URL percent-encoding
  2. CSS hex escaping
  3. JavaScript string escaping
  4. HTML entity encoding Correct answer.

Explanation

When untrusted data is placed between HTML tags as text content, HTML entity encoding converts characters like < and > into entities so they cannot form tags. JavaScript, URL, and CSS encodings apply to their respective contexts. Using the wrong context encoding leaves injection possible.

Question 29Cross-Site Scripting (XSS)

Which JavaScript sink is most directly associated with DOM-based XSS when fed attacker-controlled data?

  1. console.log
  2. element.innerHTML Correct answer.
  3. JSON.parse
  4. Math.round

Explanation

Assigning untrusted data to innerHTML causes the browser to parse it as markup, enabling script injection. console.log, Math.round, and JSON.parse do not interpret input as executable HTML. Sinks like innerHTML are the classic DOM XSS vector.

Question 30Cross-Site Scripting (XSS)

What does the HttpOnly flag on a session cookie accomplish in the context of XSS?

  1. It prevents client-side JavaScript from reading the cookie value Correct answer.
  2. It restricts the cookie to same-site requests only
  3. It expires the cookie after a single request
  4. It encrypts the cookie contents in transit

Explanation

HttpOnly instructs the browser to hide the cookie from document.cookie, so injected scripts cannot steal the session token. It does not encrypt the value or limit cross-site sending. It reduces impact but does not stop XSS from performing actions as the user.

Question 31Cross-Site Scripting (XSS)

A penetration tester observes that a search term appears in the page source inside a script block as var q = 'term';. Which encoding is required to safely place the value there?

  1. HTML entity encoding only
  2. CSS escaping
  3. Base64 encoding
  4. JavaScript string escaping including quotes and backslashes Correct answer.

Explanation

Data inside a script block must be escaped for the JavaScript string context, covering quotes, backslashes, and line terminators. HTML entity encoding does not prevent breaking out of a JS string. Base64 and CSS escaping do not fit this context.

Question 32Cross-Site Scripting (XSS)

Which technique best mitigates stored XSS in user-generated content that must allow limited HTML formatting?

  1. Disabling JavaScript in the browser
  2. Escaping all input at the database layer
  3. Blocking the <script> tag with a string replace
  4. Sanitizing markup with an allowlist-based HTML sanitizer before storage or rendering Correct answer.

Explanation

Allowlist sanitizers parse the markup and strip dangerous elements and attributes while preserving safe formatting. Naive string replacement of <script> is bypassable via event handlers and other vectors. Database escaping and browser settings do not address stored output rendering.

Question 33Cross-Site Scripting (XSS)

A tester finds that the payload <img src=x onerror=alert(1)> executes when a profile page loads. Which vulnerability type is demonstrated?

  1. DOM-based XSS
  2. Self-XSS
  3. Reflected XSS
  4. Stored XSS Correct answer.

Explanation

The payload persists in a profile field and executes whenever the page is viewed, which is the defining trait of stored XSS. Reflected XSS executes only from the immediate request, and DOM-based XSS originates in client-side sinks. Self-XSS requires the victim to paste code themselves.

Question 34Cross-Site Scripting (XSS)

Which Content-Security-Policy directive value most effectively blocks inline script execution while allowing scripts from the same origin?

  1. default-src *
  2. script-src 'unsafe-inline' 'self'
  3. script-src 'self' Correct answer.
  4. script-src 'unsafe-eval'

Explanation

script-src 'self' permits same-origin scripts and blocks inline execution because no unsafe-inline or nonce is present. Adding unsafe-inline re-enables inline scripts, defeating the purpose. default-src * and unsafe-eval weaken the policy substantially.

Question 35Cross-Site Scripting (XSS)

What is the primary purpose of a nonce in a Content-Security-Policy script-src directive?

  1. To verify the integrity of external scripts
  2. To cache scripts on the client for performance
  3. To encrypt inline scripts before transmission
  4. To allow specific inline scripts identified by a unique per-response value Correct answer.

Explanation

A nonce is a random value generated per response and attached to approved script tags, letting the browser run those inline scripts while blocking others. It does not encrypt or cache scripts. Integrity verification is handled by Subresource Integrity hashes.

Question 36Cross-Site Scripting (XSS)

A URL parameter is read by client-side JavaScript and written into document.write(). Where should the fix be applied?

  1. In the database schema
  2. In the TLS configuration
  3. Only in the server-side template engine
  4. In the client-side code, avoiding dangerous sinks and using safe DOM APIs Correct answer.

Explanation

DOM-based XSS originates entirely in client-side code, so remediation belongs in the JavaScript that reads the source and writes to the sink. Server templates and database schemas do not process this flow. TLS has no bearing on script injection.

Question 37Cross-Site Scripting (XSS)

Which attribute-based payload is commonly used to execute JavaScript without a script tag when an image fails to load?

  1. onerror Correct answer.
  2. alt
  3. srcset
  4. href

Explanation

The onerror event handler fires when an image resource fails, executing its JavaScript value. The href, srcset, and alt attributes are not event handlers and do not execute script on their own. Event-handler attributes are a frequent filter bypass.

Question 38Cross-Site Scripting (XSS)

Why is blacklist filtering of the string javascript: insufficient for protecting an href attribute?

  1. Because javascript: is not a valid scheme
  2. Because browsers ignore all URL schemes in href
  3. Because href attributes never execute script
  4. Encoding and case variations plus other schemes can bypass simple string matching Correct answer.

Explanation

Attackers can use mixed case, HTML entities, or whitespace to evade naive matching, and other schemes may also be dangerous. Proper URL validation with an allowlist of safe schemes is more reliable. href does execute javascript: URLs, so the other options are false.

Question 39Cross-Site Scripting (XSS)

Which SameSite cookie attribute value provides the strongest restriction against cross-site requests carrying the cookie?

  1. Lax
  2. Default
  3. Strict Correct answer.
  4. None

Explanation

SameSite=Strict withholds the cookie from all cross-site requests, offering the strongest restriction. Lax permits top-level navigations, None allows cross-site sending, and Default varies by browser. This limits CSRF-style impact but is not a direct XSS fix.

Question 40Cross-Site Scripting (XSS)

A tester wants to confirm whether a reflected parameter is vulnerable in an HTML attribute context. Which payload is most appropriate for testing attribute breakout?

  1. %00
  2. ../../etc/passwd
  3. '; DROP TABLE users;--
  4. "><script>alert(1)</script> Correct answer.

Explanation

In an attribute context, breaking out requires closing the attribute quote and tag before injecting script. The SQL injection, path traversal, and null-byte payloads target different vulnerabilities. Context-aware testing determines which breakout characters are needed.

Question 41Cross-Site Scripting (XSS)

What role does the X-XSS-Protection header play in modern browsers?

  1. It fully blocks all reflected XSS payloads
  2. It encrypts the response body
  3. It enforces HTTPS for all subresources
  4. It is largely deprecated and replaced by Content-Security-Policy Correct answer.

Explanation

The legacy X-XSS-Protection header relied on browser filters that are removed or deprecated in modern browsers and could introduce side channels. Content-Security-Policy is the recommended replacement. It does not encrypt responses or enforce HTTPS.

Question 42Cross-Site Scripting (XSS)

An application uses a templating engine with auto-escaping enabled. A developer inserts user input into a template variable rendered in an HTML context. What is the expected result?

  1. The input is stored unescaped in the database
  2. Special characters are entity-encoded, preventing tag injection Correct answer.
  3. The template engine disables CSP
  4. The input is executed as JavaScript

Explanation

Auto-escaping template engines encode context-appropriate special characters, so injected markup renders as text rather than executing. The engine does not execute input as script or alter CSP. Developers must still avoid bypassing escaping with raw-output helpers.

Question 43Cross-Site Scripting (XSS)

Which DOM API is considered a safer alternative to innerHTML for inserting untrusted text?

  1. outerHTML
  2. textContent Correct answer.
  3. document.write
  4. insertAdjacentHTML

Explanation

textContent inserts data as plain text and never parses it as HTML, eliminating markup injection. document.write, outerHTML, and insertAdjacentHTML all parse markup and can execute injected scripts. Choosing text-safe sinks is a core DOM XSS defense.

Question 44Cross-Site Scripting (XSS)

A reflected XSS payload is blocked by a web application firewall but executes when the parameter is submitted with double URL encoding. What does this indicate?

  1. The browser is blocking the payload
  2. The application has no XSS vulnerability
  3. The WAF decodes once while the application decodes again, creating a decoding mismatch Correct answer.
  4. The WAF is enforcing CSP correctly

Explanation

Differential decoding between the filter and the application allows encoded payloads to pass inspection and later decode into active markup. This is a classic filter bypass pattern. It confirms rather than refutes the vulnerability.

Question 45Cross-Site Scripting (XSS)

Which scenario best describes mutation XSS (mXSS)?

  1. A user pastes a payload into their own console
  2. A sanitizer produces markup that the browser re-parses into executable form Correct answer.
  3. A cookie is stolen via document.cookie
  4. A server stores the payload and serves it to other users

Explanation

Mutation XSS occurs when sanitizer output is altered by browser parsing rules, causing supposedly safe markup to become executable. Stored XSS describes persistence, cookie theft is an impact, and console pasting is self-XSS. mXSS exploits parser discrepancies rather than storage.

Question 46Cross-Site Scripting (XSS)

A CSP uses script-src 'strict-dynamic' with a nonce. What behavior does this enable?

  1. Scripts loaded by an already-trusted script are allowed without further nonces Correct answer.
  2. External scripts from any origin are blocked permanently
  3. All inline scripts are permitted regardless of nonce
  4. eval() is explicitly allowed

Explanation

strict-dynamic propagates trust from a nonced script to scripts it dynamically loads, which suits modern bundlers. It does not permit arbitrary inline scripts or enable eval. Host allowlists are effectively ignored under strict-dynamic.

Question 47Cross-Site Scripting (XSS)

An attacker injects a payload that reads the CSRF token from the page and submits a state-changing request. Which XSS impact does this illustrate?

  1. Exploiting a SQL injection flaw
  2. Bypassing CSRF defenses by executing in the victim's origin Correct answer.
  3. Performing a directory traversal
  4. Defeating TLS encryption

Explanation

Because injected script runs in the victim's origin, it can read anti-CSRF tokens and issue authenticated requests, neutralizing CSRF protections. This is a hallmark impact of XSS. It does not break TLS, SQL, or file path controls.

Question 48Cross-Site Scripting (XSS)

Why does HTML entity encoding of a value placed inside an unquoted HTML attribute fail to prevent XSS?

  1. Spaces and other characters can still terminate the attribute and introduce new attributes or tags Correct answer.
  2. Entity encoding always neutralizes attribute contexts
  3. The value is automatically placed in a script block
  4. Unquoted attributes are not parsed by browsers

Explanation

Unquoted attributes end at whitespace, so an attacker can inject a space followed by an event handler even if angle brackets are encoded. Context-specific handling and quoting are required. Entity encoding alone does not make this context safe.

Question 49Cross-Site Scripting (XSS)

Which practice most reduces the risk of DOM XSS when building a single-page application that renders user comments?

  1. Storing comments in localStorage without encoding
  2. Rendering comments with framework text bindings that escape by default and avoiding raw HTML sinks Correct answer.
  3. Injecting comments via innerHTML after a regex strip of script tags
  4. Using eval to process comment text

Explanation

Framework text bindings escape data by default, and avoiding raw HTML sinks prevents markup interpretation. eval and regex-stripped innerHTML remain dangerous, and localStorage does not encode output. Defense relies on safe sinks and default escaping.

Question 50Cross-Site Scripting (XSS)

What is the difference between反射型 and 存储型 XSS in terms of payload persistence?

  1. Reflected payloads are persisted, while stored payloads are ephemeral
  2. Both persist identically on the server
  3. Neither involves server-side storage
  4. Reflected payloads are not persisted server-side, while stored payloads are saved and served to later users Correct answer.

Explanation

Reflected XSS echoes the payload in the immediate response and does not persist, whereas stored XSS saves the payload and delivers it to subsequent visitors. Persistence determines victim scope and remediation urgency. Both are server-involved but differ in storage.