Cybersecurity Quiz: 5.17 Labs

Cross-Site Scripting (XSS) is a type of web vulnerability that allows attackers to inject malicious scripts into webpages. What is the purpose of using the following JavaScript code in an XSS attack?

<script>alert("Hacked!")</script>

• To display an alert to test for XSS vulnerabilities

• To modify the database structure

• To gain administrator access to a system

• To perform a brute force attack

In XSS Tier 1 (Juice Shop Lab), why was the following code injected into the search bar?

<iframe src="javascript:alert('XSS')">

• To test if the website allows script execution

• To log in as an administrator

• To delete the website’s database

• To change the website's background

What security setting had to be lowered in DVWA before performing XSS attacks?

• Firewall settings

• User privileges

• DVWA security level

• JavaScript permissions

In the SQL Injection (Juice Shop) lab, what did the following SQL statement allow a user to do?

' OR TRUE --

• Display all products in the store

• Bypass login authentication and access an account

• Insert new records into the database

• Encrypt the database

Why is an SQL injection attack dangerous for a database?

• It can allow an attacker to execute arbitrary SQL commands

• It slows down the server temporarily

• It only affects front-end website performance

• It is only possible with administrator privileges

During the DVWA SQL Injection lab, entering 1' OR 1=1 in the User ID field resulted in:

• An error message

• Access to the admin account

• Displaying all users in the database

• Locking the account due to failed login attempts

In the XSS DVWA lab, why did unchecking the HttpOnly flag in the PHPSESSID cookie make the website more vulnerable?

• It allowed attackers to see session IDs using JavaScript

• It disabled encryption on the webpage

• It enabled two-factor authentication bypass

• It forced the session to expire immediately

What was the main takeaway from the 'Defending Against XSS' section in both XSS labs?

• Websites should always trust user input

• Input should be sanitized to prevent script execution

• Storing passwords in plaintext prevents XSS attacks

• Users should be allowed to run JavaScript freely

In the SQL Injection (DVWA) lab, what was the significance of using the following command?

UNION SELECT null, database()#

• It displayed all user passwords

• It returned the name of the current database

• It bypassed authentication checks

• It changed the admin password

What is one effective defence against SQL injection attacks?

• Allowing all input to be executed as SQL commands

• Using prepared statements and parameterized queries

• Disabling the database firewall

• Hashing the SQL commands before execution