GWAPT Practice Questions: HTML5, Client-Side & Advanced Attacks Domain

Correct Answer: C

Explanation: The primary security risk associated with 'Access-Control-Allow-Origin: *' is that it allows any website to read sensitive data from the application, as it permits cross-origin requests from any domain. This can lead to unauthorized data access if the application exposes sensitive information via CORS. Option A is incorrect because CSRF attacks are not directly related to CORS configurations. Option B is incorrect because XSS is related to script execution, not cross-origin data sharing. Option D is incorrect because CORS does not expose server source code; it controls cross-origin data access.

Correct Answer: A

Explanation: Cross-Site Scripting (XSS) can exploit vulnerabilities where user input is not properly sanitized, allowing an attacker to inject scripts into web pages viewed by other users. If session data is stored in local storage, a successful XSS attack could allow an attacker to access and potentially steal this data. SQL Injection and CSRF do not directly target local storage, and Clickjacking involves tricking the user into clicking something they didn't intend to, not accessing local storage.

Correct Answer: C

Explanation: Location Spoofing is a potential attack on the Geolocation API if the application does not validate or sanitize the location data properly. An attacker could spoof their location to gain unauthorized access to location-based services. XSS (A) and SQL Injection (D) are unrelated to the Geolocation API specifically. Clickjacking (B) is a different type of attack that involves tricking users into clicking on something different than they perceive, which is unrelated to geolocation.

Correct Answer: C

Explanation: The correct answer is C. Local storage data can be accessed by JavaScript running in the same origin, which means if an attacker can inject JavaScript (via XSS), they can access the stored data. Option A is incorrect because local storage is origin-specific and cannot be accessed by other websites. Option B is incorrect because local storage data is not sent to the server with every HTTP request. Option D is incorrect because local storage does not automatically encrypt data.

Correct Answer: D

Explanation: Option D is correct because if the application does not validate file types, an attacker could upload a malicious script that executes on the client-side. Option A is incorrect because the File API does not inherently bypass server-side file size limits. Option B is incorrect as directory traversal typically involves server-side file access, not client-side. Option C is incorrect because the File API cannot read local files without explicit user permission.

Correct Answer: C

Explanation: The 'Access-Control-Allow-Origin: *' header allows any domain to access the application's resources, which can lead to data leaks and unauthorized access. This configuration does not restrict access to trusted domains, making it insecure. It does not directly relate to XSS attacks or user authorization.

Correct Answer: B

Explanation: B is correct because when autocomplete is set to 'on', sensitive information such as usernames or passwords may be stored in the browser, potentially accessible to unauthorized users if the device is compromised. A is incorrect because autocomplete does not directly facilitate CSRF attacks. C is incorrect because autocomplete does not relate to script injection. D is incorrect because autocomplete does not increase the risk of SQL injection vulnerabilities.

Correct Answer: A

Explanation: Option A is correct because local storage can be accessed by scripts running on the same origin, making it a vector for persistent XSS if not properly sanitized. Option B is incorrect because session storage is cleared when the page session ends, and encryption alone does not guarantee security. Option C is incorrect because modifying the manifest file is unrelated to web storage vulnerabilities. Option D is incorrect because it concerns privacy, not a web storage vulnerability.

Correct Answer: D

Explanation: The correct answer is D. HTML5 Cross-Origin Resource Sharing (CORS) is a mechanism that allows restricted resources on a web page to be requested from another domain. If CORS is improperly configured, it can be exploited to perform cross-domain attacks. Option A, Drag and Drop, is unrelated to cross-domain requests. Option B, Canvas, is used for drawing graphics. Option C, WebSockets, is used for full-duplex communication over a single TCP connection, not specifically for cross-domain resource sharing.

Correct Answer: B

Explanation: Option B is correct because a CORS misconfiguration can allow an attacker to use a malicious website to make requests to the vulnerable application and read sensitive data from the victim's browser. Option A describes SQL injection, which is unrelated to CORS. Option C pertains to cross-site scripting (XSS), not CORS. Option D describes open redirect vulnerabilities, which are also unrelated to CORS.