Cross-Site Scripting (XSS) Quiz: Test Your Knowledge of XSS Attacks

📚 Quick Study Guide

• 🛡️ XSS attacks inject malicious scripts into websites viewed by other users.
• ➡️ Reflected XSS: Malicious script is part of the URL and immediately executed.
• 💾 Stored XSS: Malicious script is stored on the target server (e.g., in a database).
• ⚙️ DOM-based XSS: Exploits vulnerabilities in client-side scripts, manipulating the DOM.
• 🔑 Sanitization: Encoding user input to prevent it from being interpreted as code.
• 🚧 Content Security Policy (CSP): An HTTP header that controls the resources the browser is allowed to load.
• 🍪 HTTPOnly Cookie Attribute: Prevents client-side scripts from accessing cookies.

Practice Quiz

1. Which type of XSS attack involves injecting malicious scripts that are permanently stored on the target server?
   • A) Reflected XSS
   • B) Stored XSS
   • C) DOM-based XSS
   • D) Blind XSS
2. What is the primary goal of an XSS attack?
   • A) To gain unauthorized access to the server.
   • B) To execute malicious scripts in the victim's browser.
   • C) To deface the website.
   • D) To perform a denial-of-service attack.
3. Which of the following is a common method to prevent XSS attacks?
   • A) Disabling JavaScript.
   • B) Encoding user input.
   • C) Using only GET requests.
   • D) Blocking all external resources.
4. What does DOM-based XSS exploit?
   • A) Server-side vulnerabilities.
   • B) Client-side vulnerabilities.
   • C) Network misconfigurations.
   • D) Database errors.
5. Which HTTP header can help mitigate XSS attacks?
   • A) Strict-Transport-Security
   • B) Content-Type
   • C) Content-Security-Policy
   • D) X-Frame-Options
6. What is the purpose of the HTTPOnly cookie attribute?
   • A) To make cookies accessible only via HTTPS.
   • B) To prevent cookies from being accessed by client-side scripts.
   • C) To encrypt cookie data.
   • D) To limit the cookie's expiration time.
7. In a reflected XSS attack, where is the malicious script typically located?
   • A) In the server's database.
   • B) In the URL parameters.
   • C) In the HTTP headers.
   • D) In a separate JavaScript file.