I85PREP
⌘ K
BSCP study materials
BSCP study resources

BSCP practice questions

One question at a time. Build your BSCP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web security vulnerability classes and exploitation

In a reflected XSS test, the payload <script>alert(1)</script> is submitted in a search parameter and appears verbatim in the response body inside an HTML text node. Which statement best describes what this confirms?

  1. The reflection proves a stored XSS issue because the value persists across visits.
  2. The application is vulnerable only if the payload also appears in an HTTP response header.
  3. The application reflects unencoded user input into an HTML context, so the browser will parse and execute the injected script. Correct answer.
  4. The payload proves SQL injection because the parameter reaches a database query.

Explanation

Reflected XSS requires that user input reach the response without context-appropriate encoding; a script tag placed in an HTML text node is parsed as markup and executed. The vulnerability is confirmed by the unencoded reflection in an executable context, not by persistence or by header reflection.

Question 2Web security vulnerability classes and exploitation

A developer wants to prevent XSS in an HTML body context by encoding the five characters & < > " '. Which control is being described?

  1. HTML entity encoding of untrusted output Correct answer.
  2. HTTP Strict Transport Security
  3. Content-Security-Policy with 'unsafe-inline'
  4. SameSite=Strict cookie attribute

Explanation

HTML entity encoding converts characters with special meaning in HTML into entities so they render as data rather than markup. This is the standard output-encoding defense for HTML body context.

Question 3Web security vulnerability classes and exploitation

An application sets a session cookie with the attributes HttpOnly and Secure. Which attack does HttpOnly most directly mitigate?

  1. Theft of the cookie value through injected JavaScript Correct answer.
  2. Session fixation caused by accepting a URL-supplied session ID
  3. Clickjacking of the login page through an iframe
  4. Cross-site request forgery against state-changing endpoints

Explanation

HttpOnly prevents client-side scripts from reading the cookie via document.cookie, so an XSS payload cannot directly exfiltrate the session identifier. It does not address CSRF, session fixation, or framing.

Question 4Web security vulnerability classes and exploitation

During testing, a parameter value is reflected inside a JavaScript string literal in a script block: var q = 'PAYLOAD';. Which payload best demonstrates script execution in this context?

  1. ';alert(1)// Correct answer.
  2. javascript:alert(1)
  3. "><img src=x onerror=alert(1)>
  4. <script>alert(1)</script>

Explanation

Inside a quoted JavaScript string, breaking out with a single quote and commenting out the remainder allows arbitrary script to run. HTML tags are inert inside a script block, so angle-bracket payloads do not execute there.

Question 5Web security vulnerability classes and exploitation

A web application builds SQL as SELECT * FROM users WHERE name = 'INPUT'. Which input most directly demonstrates SQL injection in this quoted string context?

  1. ../../etc/passwd
  2. ' OR '1'='1 Correct answer.
  3. %00
  4. <script>alert(1)</script>

Explanation

The payload closes the opening quote and adds a tautological condition, altering the query logic so it returns all rows. This is the classic quoted-string SQL injection demonstration.

Question 6Web security vulnerability classes and exploitation

A tester submits the value 1' AND SLEEP(5)-- - and observes a consistent five-second response delay, while 1' AND SLEEP(0)-- - responds immediately. Which conclusion is best supported?

  1. The application is vulnerable to reflected XSS.
  2. The parameter is injectable only through a UNION-based technique.
  3. The parameter is injectable and the database executes stacked or boolean-controlled time delays. Correct answer.
  4. The delay is caused by network latency and provides no signal.

Explanation

A delay that tracks the injected condition and disappears when the delay is set to zero is a controlled time-based blind SQL injection signal. The differential response rules out incidental latency.

Question 7Web security vulnerability classes and exploitation

An endpoint returns the same generic error page for valid and invalid input, but a UNION SELECT with a mismatched column count produces a database error. What does the differing error reveal?

  1. The application is vulnerable to command injection.
  2. The database is definitely Microsoft SQL Server.
  3. The endpoint is protected by a WAF.
  4. The number of columns in the original query can be inferred by adjusting the UNION column count. Correct answer.

Explanation

When a UNION query's column count does not match the original SELECT, the database raises an error, so varying the count until the error disappears reveals the column structure. This is a standard UNION-based enumeration step.

Question 8Web security vulnerability classes and exploitation

A file download endpoint accepts ?file=report.pdf and returns the contents of /etc/passwd when given ?file=../../../../etc/passwd. Which vulnerability class is demonstrated?

  1. Open redirect
  2. Server-side request forgery
  3. XML external entity injection
  4. Path traversal leading to arbitrary file read Correct answer.

Explanation

Using ../ sequences to escape the intended directory and read an arbitrary filesystem path is path traversal. The server resolves the supplied relative path outside its base directory.

Question 9Web security vulnerability classes and exploitation

A web server serves static files and normalizes the path by stripping ../ sequences once, then passes the result to the filesystem. Which payload is most likely to bypass this single-pass normalization?

  1. %2e%2e%2f%2e%2e%2fetc%2fpasswd
  2. /etc/passwd
  3. ....//....//etc/passwd Correct answer.
  4. ../../etc/passwd

Explanation

Removing ../ once from ....// leaves ../, so a single-pass filter can be bypassed by nesting the traversal sequence. This is a common filter-evasion technique for path traversal.

Question 10Web security vulnerability classes and exploitation

A server-side XML parser processes user-supplied XML and resolves external entities. Which payload best demonstrates file disclosure?

  1. <x><![CDATA[file:///etc/passwd]]></x>
  2. <x attr="file:///etc/passwd"/>
  3. <!DOCTYPE x [<!ENTITY e SYSTEM "file:///etc/passwd">]><x>&e;</x> Correct answer.
  4. <?xml-stylesheet href="file:///etc/passwd"?><x/>

Explanation

Defining an external entity with a file:// system identifier and referencing it causes a vulnerable parser to substitute the file contents. This is the core XXE file-disclosure technique.

Question 11Web security vulnerability classes and exploitation

A webhook feature fetches a user-supplied URL from the server. A tester submits http://169.254.169.254/latest/meta-data/ and receives cloud instance metadata. Which vulnerability is demonstrated?

  1. Cross-site scripting
  2. Server-side request forgery Correct answer.
  3. HTTP request smuggling
  4. Insecure direct object reference

Explanation

SSRF occurs when the server fetches a URL chosen by the attacker, allowing access to internal services such as the cloud metadata endpoint. The response returning metadata confirms the server made the request.

Question 12Web security vulnerability classes and exploitation

An SSRF filter blocks URLs whose host resolves to 127.0.0.1. Which technique most directly attempts to bypass this check while still reaching the loopback service?

  1. Appending a query string to the URL
  2. Supplying a hostname that resolves to a loopback address, such as a DNS name pointing to 127.0.0.1 Correct answer.
  3. Increasing the URL length beyond 2048 characters
  4. Adding an https:// scheme to the original URL

Explanation

Filters that compare the literal host string can be bypassed by using an alternate representation that resolves to loopback, such as a DNS name or decimal IP form. The server then connects to the internal address.

Question 13Web security vulnerability classes and exploitation

A form submits a POST request containing an anti-CSRF token. Which condition would allow a cross-site request forgery attack to succeed despite the token?

  1. The session cookie is marked HttpOnly.
  2. The token is validated but is not tied to the user's session and is predictable. Correct answer.
  3. The request uses the POST method.
  4. The token is random and stored in the user's session.

Explanation

CSRF tokens must be unpredictable and bound to the user's session; a predictable or session-independent token can be forged by an attacker. Random session-bound tokens prevent the attack.

Question 14Web security vulnerability classes and exploitation

An application relies solely on the Origin header to decide whether to honor a state-changing request. Which statement best describes the weakness?

  1. Origin cannot be read by servers, so the check never works.
  2. Origin is a browser-set header, but the check must still be combined with a CSRF token because some requests and non-browser clients may omit or spoof it. Correct answer.
  3. Origin checking is equivalent to SameSite=Strict and needs no token.
  4. Origin is only sent for cross-origin GET requests.

Explanation

Origin is set by browsers and is useful for CSRF defense, but non-browser clients can forge it and some requests lack it, so it should be paired with a token. Defense in depth avoids relying on a single header.

Question 15Web security vulnerability classes and exploitation

A URL parameter redirect=/dashboard is used to send users after login. Supplying redirect=https://evil.example causes the browser to navigate there. Which vulnerability is present?

  1. Open redirect Correct answer.
  2. Insecure deserialization
  3. Stored XSS
  4. Directory traversal

Explanation

An open redirect occurs when an application accepts an attacker-controlled destination and redirects the user to it. This is often chained with phishing or OAuth token theft.

Question 16Web security vulnerability classes and exploitation

A web application deserializes a cookie value using a library that instantiates classes named in the data. Which risk is most directly introduced?

  1. Remote code execution through gadget chains during deserialization Correct answer.
  2. SQL injection through the cookie parser
  3. Open redirect through the cookie domain
  4. Reflected XSS through the cookie value

Explanation

Insecure deserialization of attacker-controlled data can trigger magic methods and gadget chains that lead to code execution. The risk arises from reconstructing objects from untrusted input.

Question 17Web security vulnerability classes and exploitation

A front-end proxy forwards requests to a back-end server. The tester sends a request with both Content-Length and Transfer-Encoding: chunked headers, and the two servers disagree on message boundaries. Which vulnerability class is being tested?

  1. HTTP request smuggling Correct answer.
  2. Server-side template injection
  3. Race condition
  4. Cross-site scripting

Explanation

Request smuggling exploits discrepancies in how front-end and back-end servers parse framing headers such as Content-Length and Transfer-Encoding. The mismatch lets an attacker prepend requests to another user's connection.

Question 18Web security vulnerability classes and exploitation

A template engine evaluates the input ${7*7} and returns 49 in the rendered page. Which vulnerability is indicated?

  1. HTTP response splitting
  2. Server-side template injection Correct answer.
  3. XML external entity injection
  4. Cross-site request forgery

Explanation

When user input is evaluated as a template expression, arithmetic like ${7*7} is computed by the engine, which is the signature of server-side template injection. This can often be escalated to code execution.

Question 19Web security vulnerability classes and exploitation

A page includes <div id="out"></div> and runs document.getElementById('out').innerHTML = location.hash.substring(1);. Which payload in the URL fragment demonstrates DOM-based XSS?

  1. #%00
  2. #../../etc/passwd
  3. #<img src=x onerror=alert(1)> Correct answer.
  4. #javascript:alert(1)

Explanation

The hash value is written into innerHTML, so an HTML payload with an event handler executes when the element is parsed. This is DOM-based XSS because the sink is in client-side JavaScript.

Question 20Web security vulnerability classes and exploitation

Which client-side sink is most directly dangerous when assigned attacker-controlled data because it parses HTML and can execute event-handler payloads?

  1. element.textContent
  2. element.innerHTML Correct answer.
  3. console.log
  4. JSON.parse

Explanation

innerHTML parses its argument as HTML, so injected markup with event handlers can execute. textContent treats input as literal text and does not parse markup.

Question 21Web security vulnerability classes and exploitation

A Content-Security-Policy header is set to default-src 'self'. An attacker injects an inline <script>alert(1)</script>. What is the most likely outcome in a modern browser?

  1. The script executes because default-src does not cover scripts.
  2. The inline script is blocked because inline scripts require 'unsafe-inline' or a nonce/hash. Correct answer.
  3. The script executes because CSP only applies to images.
  4. The script is blocked only if the page also uses HTTPS.

Explanation

default-src acts as a fallback for script-src, and inline scripts are blocked unless 'unsafe-inline' or a nonce/hash is present. CSP therefore mitigates many injected inline scripts.

Question 22Web security vulnerability classes and exploitation

A tester wants to identify a blind SQL injection where no output or error is reflected and no time delay is possible. Which technique is most appropriate?

  1. Boolean-based inference by comparing responses for true and false conditions Correct answer.
  2. Out-of-band DNS exfiltration via a database function
  3. UNION-based extraction of query results
  4. Error-based extraction from database messages

Explanation

Boolean-based blind SQL injection infers data by observing whether a condition makes the page differ, even without errors or output. It works when the application returns distinguishable true and false responses.

Question 23Web security vulnerability classes and exploitation

An application stores user-supplied HTML in a comment field and renders it to all visitors without sanitization. Which vulnerability class applies?

  1. Cross-site request forgery
  2. Reflected cross-site scripting
  3. DOM-based cross-site scripting
  4. Stored cross-site scripting Correct answer.

Explanation

Stored XSS occurs when malicious input is persisted server-side and later rendered to other users without encoding. Every visitor who views the comment is exposed.

Question 24Web security vulnerability classes and exploitation

A server constructs an OS command as ping -c 1 HOST using user input. Which payload most directly demonstrates command injection?

  1. 127.0.0.1
  2. ../../etc/passwd
  3. 127.0.0.1; id Correct answer.
  4. <script>alert(1)</script>

Explanation

A shell metacharacter such as a semicolon terminates the original command and appends a second command, so id executes. This is the standard command injection demonstration.

Question 25Web security vulnerability classes and exploitation

An application uses client-side JavaScript to enforce that only administrators see the delete button, but the delete endpoint checks no role server-side. Which weakness is present?

  1. SQL injection in the delete endpoint
  2. Insecure deserialization of the delete request
  3. Cross-site scripting in the admin panel
  4. Broken access control relying on client-side restrictions Correct answer.

Explanation

Access control must be enforced on the server; hiding UI elements client-side does not prevent direct requests to the endpoint. This is a broken access control flaw.

Question 26Web security vulnerability classes and exploitation

A reflected cross-site scripting payload is being tested on a page that HTML-encodes < and > but leaves single and double quotes untouched. Which payload is most likely to succeed in a JavaScript string context inside an event handler attribute?

  1. <script>alert(document.domain)</script>
  2. \u003cscript\u003ealert(1)\u003c/script\u003e
  3. &lt;img src=x onerror=alert(1)&gt;
  4. '-alert(document.domain)-' Correct answer.

Explanation

When angle brackets are encoded but quotes are not, breaking out of a quoted JavaScript string inside an attribute is the viable path, and the payload closes the string, calls alert, and comments out the remainder. Script tags fail because < and > are encoded. Entity-encoded tags are rendered as text rather than markup.

Question 27Web security vulnerability classes and exploitation

Which HTTP response header instructs modern browsers to refuse to render a page inside a frame, thereby mitigating clickjacking without relying on JavaScript?

  1. Referrer-Policy: no-referrer
  2. X-Frame-Options: DENY Correct answer.
  3. X-Content-Type-Options: nosniff
  4. Strict-Transport-Security: max-age=31536000

Explanation

X-Frame-Options with DENY (or SAMEORIGIN) prevents the response from being framed by other origins, which removes the overlay technique used in clickjacking. The other headers address MIME sniffing, referrer leakage, and transport security respectively.

Question 28Web security vulnerability classes and exploitation

An application authenticates users by setting a cookie with the attributes HttpOnly and Secure. Which attack is most directly mitigated by HttpOnly?

  1. Replay of a captured cookie from a different client
  2. Theft of the session cookie through injected client-side script Correct answer.
  3. Forging of a valid session identifier by guessing its value
  4. Interception of the cookie on an unencrypted network segment

Explanation

HttpOnly prevents JavaScript from reading document.cookie, so even a successful cross-site scripting payload cannot exfiltrate the session identifier. Transport interception is addressed by Secure, while guessing and replay are separate design concerns.

Question 29Web security vulnerability classes and exploitation

A tester wants to determine whether a parameter is vulnerable to error-based SQL injection when the application displays database error messages. Which input most directly elicits a syntax error from a string-literal context?

  1. %00
  2. abc
  3. 1
  4. ' Correct answer.

Explanation

A single quote terminates the surrounding string literal in the generated query, producing a syntax error if the value is concatenated unsafely and errors are shown. A numeric value or plain word usually remains a valid literal, and a null byte is not a SQL string delimiter.

Question 30Web security vulnerability classes and exploitation

Which HTTP method should be avoided for state-changing operations because browsers and intermediaries may treat it as safe and cacheable?

  1. PATCH
  2. PUT
  3. GET Correct answer.
  4. POST

Explanation

GET is defined as a safe, idempotent retrieval method, so browsers, proxies, and prefetchers may issue it without user intent. Using GET for actions such as deletion enables cross-site triggering and caching side effects. The other methods are intended for state changes.

Question 31Web security vulnerability classes and exploitation

A web cache stores responses keyed only on the URL path, ignoring the X-Forwarded-Host header, yet the application reflects that header into generated links. Which class of vulnerability does this combination describe?

  1. HTTP request smuggling
  2. Open redirect
  3. Cross-site request forgery
  4. Web cache poisoning Correct answer.

Explanation

When an unkeyed input influences the cached response, an attacker can seed the cache with malicious content that is then served to other users, which is web cache poisoning. Request smuggling involves desynchronized message framing, CSRF abuses ambient credentials, and open redirect only controls navigation.

Question 32Web security vulnerability classes and exploitation

A tester observes that the application reflects the Host header value into a password-reset link sent by email. Which exploitation is most directly enabled?

  1. The email server relays messages for arbitrary senders
  2. The reset token is brute-forced offline from the email body
  3. The reset endpoint becomes vulnerable to SQL injection
  4. The reset token is delivered to an attacker-controlled domain Correct answer.

Explanation

If the Host header controls the base URL of the reset link, an attacker can request a reset for a victim with a forged Host so the emailed link points to their server, capturing the token when clicked. The other outcomes are unrelated to header reflection.

Question 33Web security vulnerability classes and exploitation

An application allows file uploads and stores them under a web-accessible directory while validating only the Content-Type header supplied by the client. Which follow-up action best tests whether this leads to code execution?

  1. Upload a script file with an image Content-Type and request it directly Correct answer.
  2. Upload a file larger than the configured size limit
  3. Upload a file with a double extension such as .jpg.txt
  4. Upload a file containing a very long filename

Explanation

Because the client-supplied Content-Type is trusted, an attacker can label an executable script as an image and then request it from the web-accessible path to see whether the server executes it. Size, filename length, and trailing extensions test different controls.

Question 34Web security vulnerability classes and exploitation

A tester finds that an endpoint returns different response lengths depending on whether a boolean condition in an injected SQL fragment is true. Which technique is being used?

  1. Out-of-band SQL injection
  2. Time-based blind SQL injection
  3. Boolean-based blind SQL injection Correct answer.
  4. Union-based SQL injection

Explanation

Boolean-based blind injection infers data one bit at a time by comparing responses for true and false conditions. Time-based relies on delays, union-based relies on visible query output, and out-of-band relies on a separate channel such as DNS.

Question 35Web security vulnerability classes and exploitation

An application uses a JSON Web Token signed with HS256 and the server accepts the algorithm named in the token header. Which attack should the tester attempt first?

  1. Re-encode the payload with a different character set
  2. Replace the token with a random Base64 string
  3. Change the header algorithm to none and remove the signature Correct answer.
  4. Append extra claims after the signature segment

Explanation

If the server honors the alg header, switching to none may cause it to accept an unsigned token, which is the classic algorithm-confusion flaw. The other options do not exploit the signing logic.

Question 36Web security vulnerability classes and exploitation

A tester discovers that the server accepts a JWT signed with HS256 when the public key is known, and attempts to sign a forged token using that public key as the HMAC secret. Which vulnerability is being tested?

  1. Missing expiration claim validation
  2. Insufficient token entropy
  3. Cross-site scripting in the token viewer
  4. Algorithm confusion between asymmetric and symmetric verification Correct answer.

Explanation

Algorithm confusion occurs when a library expecting RS256 accepts HS256 and treats the public key as a shared secret, letting anyone who knows the public key forge tokens. Expiration, entropy, and rendering issues are separate concerns.

Question 37Web security vulnerability classes and exploitation

A GraphQL endpoint exposes introspection and accepts deeply nested queries without depth limits. Which risk is most directly associated with the missing depth restriction?

  1. Resource exhaustion through a single expensive query Correct answer.
  2. Bypass of authentication on protected fields
  3. Disclosure of fields hidden from the schema
  4. Execution of operating system commands

Explanation

Unbounded nesting or aliasing lets a client request enormous amounts of work in one query, exhausting server resources. Field disclosure comes from introspection, authorization bypass from resolver flaws, and command execution from unrelated injection issues.

Question 38Web security vulnerability classes and exploitation

A server parses XML with an external DTD enabled and the tester observes that an entity referencing a local file is expanded into the response. Which vulnerability is confirmed?

  1. Insecure deserialization
  2. Cross-site scripting
  3. XML external entity injection Correct answer.
  4. Server-side request forgery

Explanation

Expansion of an entity that references a local file demonstrates XML external entity injection, since the parser resolves the entity and includes file contents. XSS is a browser-side issue, SSRF involves server-initiated requests, and deserialization concerns object reconstruction.

Question 39Web security vulnerability classes and exploitation

A tester finds that an application reflects a parameter into a JavaScript block but encodes it using HTML entities. Which bypass approach is most appropriate to investigate?

  1. Attempt to inject a script tag with an onerror handler
  2. Submit the value inside a CSS style attribute
  3. Encode the payload twice with Base64
  4. Determine whether the value is placed inside a script context where entities are not decoded Correct answer.

Explanation

HTML entity encoding is not decoded inside script blocks, so the tester must check whether a different context allows breaking out of a string or creating executable syntax. Script tags and style attributes are different contexts, and Base64 does not create execution.

Question 40Web security vulnerability classes and exploitation

A web application exposes an administrative function that checks the role from a client-supplied cookie value. Which vulnerability class does this represent?

  1. SQL injection
  2. Broken access control Correct answer.
  3. Insecure direct object reference
  4. Cross-site scripting

Explanation

Trusting a client-controlled value to make an authorization decision is a broken access control flaw, since the client can tamper with the cookie. XSS and SQL injection are different classes, and IDOR concerns object-level authorization rather than role checks.

Question 41Web security vulnerability classes and exploitation

A tester observes that incrementing an account identifier in a URL returns another user's invoice. Which vulnerability is demonstrated?

  1. Server-side request forgery
  2. XML external entity injection
  3. Cross-site request forgery
  4. Insecure direct object reference Correct answer.

Explanation

Changing an object identifier to reach another user's resource without an authorization check is an insecure direct object reference. The other classes involve server-initiated requests, forced authenticated actions, and XML entity expansion.

Question 42Web security vulnerability classes and exploitation

An application runs behind a reverse proxy that strips the X-Forwarded-For header, but the application trusts a header named X-Real-IP for IP-based access control. Which action best tests this trust?

  1. Send a request with a different User-Agent
  2. Send a request with a malformed Content-Length
  3. Send a request with an oversized body
  4. Send a request with a spoofed X-Real-IP value matching an allowed address Correct answer.

Explanation

If the application trusts X-Real-IP without the proxy enforcing it, a client can supply an allowed address and bypass IP restrictions. Body size, Content-Length, and User-Agent do not target the header-trust flaw.

Question 43Web security vulnerability classes and exploitation

A tester wants to exploit a server-side template injection where the engine allows access to language objects. Which payload best confirms code execution capability beyond simple arithmetic?

  1. <%= 7*7 %>
  2. {{7*7}}
  3. ${7*7}
  4. ${T(java.lang.Runtime).getRuntime().exec('id')} Correct answer.

Explanation

Reaching a runtime object and invoking exec demonstrates that the template can call arbitrary language methods, which goes beyond arithmetic evaluation. The other payloads only show that expressions are evaluated.

Question 44Web security vulnerability classes and exploitation

An application accepts a serialized Java object in a cookie and deserializes it before authentication. Which tool-assisted technique is most relevant to demonstrating impact?

  1. Changing the cookie encoding from Base64 to hex
  2. Appending a second cookie with the same name
  3. Supplying a crafted gadget chain that triggers a side effect during deserialization Correct answer.
  4. Replaying the cookie with a longer timeout value

Explanation

Insecure deserialization impact is demonstrated by a gadget chain that executes code or causes a side effect when the object graph is reconstructed. Timeouts, encodings, and duplicate cookies do not exercise the deserialization sink.

Question 45Web security vulnerability classes and exploitation

A tester observes that a parameter value is passed to an LDAP query as (&(uid=USER)(password=PASS)). Which payload most directly tests for LDAP injection in the username field?

  1. admin'--
  2. <script>alert(1)</script>
  3. *)(uid=*))(|(uid=* Correct answer.
  4. ../../etc/passwd

Explanation

LDAP filters use parentheses and logical operators, so injecting wildcard and filter syntax can alter the query logic and bypass the password check. The other payloads target SQL, HTML, and filesystem contexts.

Question 46Web security vulnerability classes and exploitation

Which condition most directly makes a cross-site request forgery attack feasible against a state-changing endpoint?

  1. The response includes a JSON content type
  2. The endpoint uses the POST method
  3. The request relies solely on an ambient cookie and has no unpredictable anti-CSRF token Correct answer.
  4. The session cookie has the Secure attribute

Explanation

CSRF works when the browser automatically attaches credentials and the server cannot distinguish a forged request because no unpredictable token is required. Method choice, response type, and Secure alone do not prevent forgery.

Question 47Web security vulnerability classes and exploitation

A tester observes that the application sets a session cookie without the SameSite attribute and performs cross-site POST requests to change the account email. Which mitigation most directly addresses this specific issue?

  1. Shorten the session timeout
  2. Enable HTTP Strict Transport Security
  3. Add the HttpOnly attribute to the session cookie
  4. Set SameSite=Lax or Strict on the session cookie and require an anti-CSRF token Correct answer.

Explanation

SameSite restricts cross-site cookie sending and an unpredictable token ensures the request originated from the application, together blocking the forgery. HttpOnly, HSTS, and timeouts address different threats.

Question 48Web security vulnerability classes and exploitation

A web server supports HTTP/2 on the front end and HTTP/1.1 on the back end, and the tester can inject CRLF into a header value. Which attack class should be investigated?

  1. Open redirect
  2. Directory traversal
  3. Cross-site scripting
  4. HTTP request smuggling Correct answer.

Explanation

Protocol translation combined with CRLF injection can desynchronize how the front end and back end frame requests, which is request smuggling. XSS, open redirect, and traversal are unrelated to message framing.

Question 49Web security vulnerability classes and exploitation

A tester finds that a PDF generator fetches remote images referenced in HTML supplied by users. Which vulnerability is most directly suggested?

  1. DOM-based cross-site scripting
  2. Server-side request forgery Correct answer.
  3. Client-side template injection
  4. Insecure direct object reference

Explanation

When the server fetches resources named in user-supplied HTML, an attacker can point the fetch at internal services, which is SSRF. The other classes involve client-side template evaluation, DOM sinks, or object identifiers.

Question 50Web security vulnerability classes and exploitation

An application blocks requests to 127.0.0.1 but allows arbitrary hostnames. Which technique most directly attempts to reach the loopback interface while bypassing the blocklist?

  1. Add a query string to the URL
  2. Use a hostname that resolves to 127.0.0.1, such as a DNS record the attacker controls Correct answer.
  3. Use the HTTPS scheme instead of HTTP
  4. Send the request with a different Accept header

Explanation

Blocklists that match the literal address are bypassed by a hostname resolving to the same address, since the check occurs before resolution. Scheme changes, query strings, and headers do not alter the destination address.