Cross-site scripting (XSS) in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary goal of a Cross-site scripting (XSS) attack?

Choose the option that best describes the main purpose of an XSS attack.

A To gain unauthorized access to a website's backend database directly

B To overload a website's server with excessive traffic causing it to crash

C To inject malicious scripts into trusted websites to steal user data or hijack sessions

D To encrypt user data on a website and demand ransom for decryption

💡 Hint

Think about what happens when attackers insert harmful code into web pages viewed by others.

XSS attacks aim to inject malicious scripts into web pages that other users trust. This allows attackers to steal cookies, session tokens, or perform actions on behalf of users.

📋 Factual

intermediate

Which type of XSS attack occurs when malicious code is permanently stored on the target server?

Select the correct type of XSS attack based on the description.

A Reflected XSS

B Stored XSS

C DOM-based XSS

D Blind XSS

💡 Hint

This type of XSS saves the malicious script in the website's database or message forum.

Stored XSS happens when the malicious script is saved on the server and served to users later, unlike reflected XSS which is temporary.

🔍 Analysis

advanced

What is the main difference between Reflected XSS and DOM-based XSS?

Analyze the following options and select the one that correctly explains the key difference.

A Reflected XSS involves server-side script injection, while DOM-based XSS manipulates client-side scripts without server involvement

B Reflected XSS stores malicious code in the database, DOM-based XSS does not

C DOM-based XSS requires user interaction, Reflected XSS does not

D Reflected XSS only affects mobile browsers, DOM-based XSS affects desktop browsers

💡 Hint

Consider where the malicious script is processed: on the server or in the user's browser.

Reflected XSS involves the server reflecting malicious input back to the user, while DOM-based XSS happens entirely in the browser by manipulating the page's Document Object Model.

🚀 Application

advanced

Which of the following is the most effective way to prevent XSS attacks in web applications?

Select the best practice that helps stop XSS attacks.

A Validating and encoding user input before displaying it on web pages

B Disabling JavaScript entirely on the website

C Using complex passwords for user accounts

D Installing antivirus software on the server

💡 Hint

Think about how user input can be safely handled to avoid running harmful scripts.

Validating and encoding user input ensures that any malicious code is treated as text, not executable code, preventing XSS attacks.

❓ Reasoning

expert

A website uses a search feature that reflects user input in the URL and page content without encoding. Which XSS vulnerability is this, and what is the likely impact?

Identify the XSS type and explain the potential risk to users.

A Blind XSS; attackers inject scripts that never execute visibly but steal data silently

B Stored XSS; attackers permanently save scripts that affect all users visiting the site

C DOM-based XSS; attackers modify the page structure after it loads without server interaction

D Reflected XSS; attackers can trick users into clicking malicious links that execute harmful scripts

💡 Hint

Consider how user input is handled and when the malicious script runs.

When user input is reflected immediately in the page without encoding, it is a Reflected XSS vulnerability. Attackers can craft links that execute scripts when clicked, stealing data or hijacking sessions.