PEN-200 Client-Side Attacks Practice Test 2 — 15 Questions

Question 1

During an assessment, you identify a Cross-Site Scripting vulnerability that allows you to execute arbitrary JavaScript in the context of a victim user's browser session. What is the primary objective of leveraging this capability against an authenticated user?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Hijacking the user session by accessing session tokens or performing actions on their behalf within the application. XSS allows attackers to execute scripts in the victim browser session, giving them access to document.cookie, local storage, and the ability to perform actions on behalf of the user. This effectively hijacks their session without needing to crack their underlying password.

Answer

Extracting plaintext password hashes directly from the remote web server operating system memory

Answer

Modifying the enterprise DNS records hosted on the primary domain controller via client-side DOM manipulation

Answer

Bypassing enterprise firewall packet inspection rules by encapsulating shellcode inside HTTPS headers

Question 2

When evaluating a web application for Cross-Site Scripting vulnerabilities during a penetration test, which TWO input contexts should you examine because they frequently lead to executable script injection?

Accepted Answer

Input reflected directly between opening and closing HTML tags, such as

USER_INPUT

. XSS occurs when untrusted user input is rendered in an unsafe context within the HTML document. Examining input reflected directly inside HTML body tags or inside event handler attributes (like onload or onerror) are primary areas where browsers will evaluate injected strings as executable JavaScript.

Answer

Input processed by a backend database stored procedure for primary key generation

Answer

Input stored as an encrypted binary blob inside the browser local session storage

Answer

Input utilized as a parameter value inside a server-side JSON response header without content-type sniffing

Question 3

You are performing a client-side phishing engagement and need to deliver a malicious payload using an ISO image file. Why is this delivery method often effective against modern Windows security warnings?

Accepted Answer

Windows natively mounts ISO files without requiring external software, and extracted payloads can evade certain Mark of the Web propagation behaviors. ISO image files can be mounted natively by Windows without third-party software, and files contained within the ISO often inherit a lower severity of Mark of the Web restrictions when extracted or executed, helping bypass certain SmartScreen prompts compared to direct web downloads.

Answer

ISO files automatically disable Windows Defender Antivirus real-time protection upon mounting

Answer

ISO files encrypt all internal payload binaries, rendering static signature analysis completely impossible

Answer

Mark of the Web attributes are permanently stripped from all files stored within virtual disk containers

Question 4

Refer to the exhibit. ```http HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'

Welcome

``` Based on the HTTP response headers and body shown in the exhibit, what significant security risk is present regarding client-side attacks?

Accepted Answer

The 'unsafe-inline' directive permits the execution of inline scripts, undermining CSP protections against Cross-Site Scripting. The inclusion of the 'unsafe-inline' directive in the Content Security Policy script-src allows the browser to execute inline script blocks present in the HTML. This configuration largely defeats the protective benefits of a CSP against Cross-Site Scripting, as attackers who can inject inline scripts will achieve execution.

Answer

The application is completely immune to Cross-Site Scripting because a Content Security Policy is strictly enforced

Answer

The server is vulnerable to remote code execution because the nginx version header is explicitly exposed

Answer

The session token is vulnerable to interception because the response is transmitted over unencrypted HTTP

Question 5

When testing for DOM-based XSS, where should you focus your analysis to find the vulnerable code?

Accepted Answer

The application's source code, specifically looking for sinks like eval() or innerHTML.. DOM-based XSS occurs entirely on the client side, where JavaScript takes data from a 'source' (like the URL fragment) and passes it to a 'sink' (like innerHTML) without proper sanitization. Analyzing the client-side JavaScript code is essential to trace the data flow from these sources to the execution sinks. This is critical because the server might never see the malicious payload at all.

Answer

The server-side application logs for suspicious input patterns.

Answer

The database queries for evidence of script injection.

Answer

The server's response headers to check for security misconfigurations.

Question 6

Which property of a URL is most commonly used as a source for DOM-based XSS because it is not sent to the server?

Accepted Answer

The URL fragment (everything after the # character).. The URL fragment (the part after the # character) is strictly handled by the browser and is never included in the HTTP request sent to the server. Because developers often assume this data is 'safe' or ignored by the backend, they frequently fail to sanitize it before using it in client-side operations, creating an ideal vector for DOM-based XSS attacks that bypass traditional WAFs.

Answer

The query string (everything after the ? character).

Answer

The HTTP Referer header.

Answer

The user-agent string.

Question 7

Which of the following describes the 'Open Redirect' vulnerability often used in phishing attacks?

Accepted Answer

The application uses user-supplied parameters to control the destination of a redirect.. Open Redirect occurs when an application accepts user-supplied input to determine a destination URL without validating it against a whitelist. Attackers exploit this to redirect users to a malicious site. Because the URL starts with the trusted domain, victims are less likely to suspect a phishing attempt, making it a highly effective social engineering technique to steal credentials or deliver malware.

Answer

The application reflects user input into the HTML body, allowing for XSS.

Answer

The application fails to set the Secure flag on cookies during redirection.

Answer

The application allows arbitrary file uploads to the server's redirect directory.

Question 8

What is the primary objective of a 'Clickjacking' attack?

Accepted Answer

To trick users into clicking on a hidden element, often to perform unauthorized actions.. Clickjacking tricks users into clicking something different from what they perceive, often by overlaying a hidden, malicious iframe over a legitimate page element. The objective is to force the user to perform unintended actions, like changing account settings or transferring funds, while they believe they are interacting with the benign UI. This leverages the user's existing session to execute authorized requests without their informed consent.

Answer

To steal the user's session cookies through hidden JavaScript execution.

Answer

To bypass the Same-Origin Policy by forcing cross-domain requests.

Answer

To inject malicious scripts into the page to capture keystrokes.

Question 9

During an authorized penetration test, you discover that a web application’s password reset page reflects the `email` parameter inside a JavaScript string literal with no output encoding. You want to execute arbitrary JavaScript in a victim’s browser when they click a crafted password-reset link. Which payload should you use?

Accepted Answer

`";alert(document.domain)//`. The reflection occurs inside a JavaScript string literal, so the payload must first break out of that string using a matching quote, then execute code. The double-quote-based payload with a comment terminator achieves this while preserving the rest of the script’s syntax. HTML-oriented payloads fail because the parser is already inside a script data state, not an HTML tag or attribute context.

Answer

`<script>alert(document.domain)</script>`

Answer

`' onmouseover='alert(document.domain)`

Answer

`javascript:alert(document.domain)`

Question 10

During an authorized internal penetration test, you discover that the corporate proxy does not perform SSL inspection and allows outbound HTTPS to any destination. You need to deliver a client-side payload over HTTPS while evading signature-based network detection. Which technique is most appropriate?

Accepted Answer

Serve the payload from a valid TLS certificate on a domain categorized as business-related, using domain fronting through a CDN.. Domain fronting through a CDN with a valid certificate and a business-categorized domain conceals the true destination in the TLS SNI, allowing the payload to be delivered over HTTPS while blending with legitimate traffic. This evades signature-based network detection that relies on domain or IP reputation.

Answer

Send the payload as a base64-encoded attachment in a plain SMTP email to the target user.

Answer

Host the payload on an unregistered domain with a self-signed certificate and rely on the user to click through the browser warning.

Answer

Embed the payload in an ICMP echo request and use a custom tunnel to the target workstation.

Question 11

You are testing a web application that sets a session cookie with the HttpOnly flag. You find a reflected XSS vulnerability on a page that does not require authentication. What is the primary impact of exploiting this XSS given the HttpOnly flag?

Accepted Answer

You can execute arbitrary JavaScript in the victim’s browser to perform actions as the victim, but you cannot directly read the session cookie via document.cookie.. HttpOnly is designed to prevent client-side scripts from reading cookie values, but it does not prevent script execution or stop the browser from sending the cookie with requests. An attacker who achieves XSS can still act as the victim by issuing requests, reading page content, or capturing keystrokes. The session cookie may be inaccessible to document.cookie, but the authenticated session remains exploitable.

Answer

You can read the session cookie using document.cookie because HttpOnly only applies to cookies set over HTTPS.

Answer

You can bypass HttpOnly by using XMLHttpRequest to fetch the cookie from the server’s response headers.

Answer

You cannot execute JavaScript at all because HttpOnly blocks all script execution on the page.

Question 12

During an authorized penetration test, you deliver a malicious script to a victim's browser by exploiting a reflected XSS vulnerability. The script executes in the context of the vulnerable application and silently sends a crafted HTTP request to the application's password-change endpoint. The victim is currently authenticated. Which client-side attack technique are you performing?

Accepted Answer

Cross-Site Scripting (XSS)-based request forgery. The correct technique is XSS-based request forgery, where JavaScript executed via XSS in the victim's browser is used to send authenticated requests to the application. Because the script runs in the origin of the vulnerable site, it can read anti-CSRF tokens and include them in the forged request, defeating typical CSRF protections. This is a client-side attack that combines script execution with request forgery.

Answer

DOM-based XSS

Answer

Cross-Site Request Forgery (CSRF)

Answer

Clickjacking

Question 13

You are performing a client-side attack against a target web application that uses a Content Security Policy (CSP) with the directive `script-src 'self'`. Which TWO techniques are most likely to bypass this CSP and execute JavaScript in a victim’s browser? (Choose two.)

Accepted Answer

Exploiting a JSONP endpoint on the target domain that reflects a callback parameter into executable JavaScript.. A CSP with script-src 'self' trusts scripts loaded from the target’s own origin. Therefore, an attacker who can host or reflect JavaScript on that origin bypasses the policy. Uploading a JavaScript file and loading it via a script tag, or abusing a same-origin JSONP endpoint, both result in script execution from a trusted origin. External scripts, inline scripts, and data URIs are blocked because they do not match 'self'.

Answer

Using an open redirect on the target domain to load a script from an external domain.

Answer

Using a data: URI in a script tag to embed the JavaScript payload.

Answer

Injecting an inline script tag with the payload directly into the HTML.

Question 14

You are assessing a web application that uses a strict Content Security Policy (CSP) with nonce-based script-src. You discover a reflected XSS vulnerability where your input is inserted into an existing <script> block that already has a valid nonce. Which action would most likely allow your JavaScript to execute despite the CSP?

Accepted Answer

Inject JavaScript code directly into the existing script block, leveraging the valid nonce.. The most effective action is to inject JavaScript directly into the existing script block that already carries a valid nonce. Since the CSP trusts scripts with that nonce, any code within that block executes without violation. This bypasses the need to create new script elements or guess nonces. It exploits the fact that the application reflects user input into a trusted script context, allowing arbitrary code execution.

Answer

Inject a new <script> tag with a guessed nonce value.

Answer

Use a data: URI in an iframe to execute JavaScript.

Answer

Break out of the existing script context and inject a new script element without a nonce.

Question 15

You are assessing a web application that reflects user input into an HTML attribute value without quotes, such as `<input value=USER_INPUT>`. Which payload is most likely to execute JavaScript in the victim’s browser?

Accepted Answer

`onmouseover=alert(document.domain)`. In an unquoted HTML attribute, attribute boundaries are defined by whitespace. Injecting a space followed by a new event handler attribute, such as onmouseover=alert(document.domain), adds executable JavaScript to the element. When the corresponding event fires, the code runs. Payloads that rely on quotes or script tags fail because the parser is already inside an attribute value and does not interpret them as structure.

Answer

`' onmouseover='alert(document.domain)`

Answer

`javascript:alert(document.domain)`

Answer

`"><script>alert(document.domain)</script>`