SEH Week 4 Review

Question 1

Which of the following are types of XSS attacks? (Select all that apply.)

Accepted Answer

Stored XSS, Reflected XSS

Question 2

In SQL injection, what does the 'UNION SELECT' statement primarily facilitate?

Accepted Answer

Merging results from two different database queries.

Question 3

The Intruder tool in Burp Suite is used to test the uniqueness of session tokens.

Accepted Answer

False

Question 4

What are the primary responsibilities of server-side technologies?

Accepted Answer

Managing databases., Executing core application logic.

Question 5

In the context of web security, what is the primary purpose of using HTTP Strict-Transport-Security (HSTS)?

Accepted Answer

To enforce secure connections to the server.

Question 6

Which tool is widely used to automate SQL injection attacks?

Accepted Answer

SQLMap

Question 7

XSS (Cross-Site Scripting) is a vulnerability type that allows attackers to execute scripts in the victim’s browser.

Accepted Answer

True

Question 8

Which function is commonly used in SQLi enumeration to identify the database version?

Accepted Answer

version()

Question 9

Which of the following are key mitigation strategies against SQLi attacks? (Select all that apply.)

Accepted Answer

Implementing web application firewalls (WAF)., Use of prepared statements.

Question 10

What is the primary consequence of a cross-site scripting (XSS) attack?

Accepted Answer

Client-side script execution.

Question 11

Which of the following is a server-side scripting language designed primarily for web development?

Accepted Answer

PHP

Question 12

What is the main goal of an SQLi attack flow?

Accepted Answer

Manipulate or access database information.

Question 13

Which of the following statements are true about stored XSS attacks? (Select all that apply.)

Accepted Answer

The script is stored on the server., Affects multiple users.

Question 14

Which of the following are common methods used to detect vulnerabilities in web applications? (Select all that apply.)

Accepted Answer

Conducting penetration testing., Using traffic interception tools like Burp Suite.

Question 15

What does the X-Frame-Options HTTP header prevent?

Accepted Answer

Clickjacking attacks

Question 16

What functionalities does Burp Suite provide?

Accepted Answer

Traffic interception and manipulation., Repetitive transmission handling.

Question 17

What type of XSS attack stores the malicious script on the server?

Accepted Answer

Stored XSS

Question 18

JavaScript is used for server-side SQLi attacks.

Accepted Answer

False

Question 19

What is the primary purpose of the HTTP POST method?

Accepted Answer

Sending data to a server to create or update a resource.

Question 20

Identify three tools used for HTTP method detection.

Accepted Answer

Burp Suite, Nmap, cURL

Questions 20