WEB APP SECURITY · QUIZ

Web Application Security Quiz

OWASP-style scenarios covering injection, auth, XSS, CSRF, access control, and common web flaws.

Switch to Secure Coding Switch to Cloud Security

September 2026 · monthly

Leaderboard

No public scores yet this month. Opt in under Email, then finish the quiz.

Welcome to your Web Application Security Quiz

This quiz is designed to test your knowledge and understanding of the crucial practice of web application security. Web application penetration testing is a process where professionals assess the security vulnerabilities within web applications to ensure they are safeguarded against potential cyber threats. By taking this quiz, you'll have the opportunity to evaluate your comprehension of concepts like identifying vulnerabilities, exploiting weaknesses, and recommending solutions. Whether you're an aspiring security professional or simply curious about the world of web application security, this quiz will provide valuable insights into the realm of cybersecurity. Good luck and enjoy the quiz!

Name

Show my name on this month's leaderboard Optional.

What is the purpose of a "null byte" (%OO) in a web application attack?

To terminate a string and prevent further processing

To bypass input validation filters

To perform a directory traversal attack

To conduct a timing attack

None

Which security vulnerability involves an attacker tricking a user into performing actions they did not intend to by clicking on something different from what the user perceives?

Cross-Site Scripting (XSS)

Cross-Site Request Forgery (CSRF)

Clickjacking

Remote Code Execution (RCE)

None

You're interested in gathering information about the services and versions running on open ports of a target host. Which Nmap command should you use?

nmap -sS target.com

nmap -sC target.com

nmap -sU target.com

nmap -sV target.com

None

You're designing a web application and need to store user passwords securely. Which of the following methods is the recommended approach for storing passwords in a database?

Storing passwords in plain text.

Using a symmetric encryption algorithm on passwords.

Hashing passwords with a strong one-way hashing algorithm.

Encoding passwords using Base64 before storage.

None

You've identified a potential Blind SQL Injection vulnerability in a web application. To confirm the vulnerability, you plan to extract the database version. Provide the SQL injection payload you would use for this purpose.

' OR 1=1;--

'; SELECT @@version;--

'; DROP TABLE users;--

' UNION SELECT null, @@version;--

None

Which types of encryption are used during the SSL/TLS handshake process? Select all that apply.

Symmetric Encryption

Asymmetric Encryption

Compression

Asymmetric Encryption & Symmetric Encryption

None

What is the difference between a session hijacking attack and a cookie hijacking attack?

A session hijacking attack steals the victim's session cookie, while a cookie hijacking attack steals the victim's session ID.

A session hijacking attack is more difficult to perform, but it is also more stealthy.

A cookie hijacking attack is easier to perform, but it is also more easily detected.

Both session hijacking attacks and cookie hijacking attacks are equally difficult to perform and detect.

None

GET /api/orders/1042 returns your order, but GET /api/orders/1043 returns another user's order when you change only the ID. What is the flaw?

Insecure Direct Object Reference (IDOR)

SQL Injection

Cross-Site Scripting (XSS)

Clickjacking

None

A profile feature fetches https://user-supplied-url.example from server-side code. An attacker sends http://169.254.169.254/latest/meta-data/. What vulnerability is this?

Server-Side Request Forgery (SSRF)

Cross-Site Scripting (XSS)

XML External Entity (XXE)

Open Redirect

None

10.

You capture a JWT with header {"alg":"none","typ":"JWT"} and an unsigned payload. The API accepts it. What went wrong?

The server accepted the "none" algorithm and skipped signature verification

The JWT was expired

The token used RS256 instead of HS256

The payload was Base64 encoded twice

None

11.

https://app.example/login?next=https://evil.example/phish redirects users off-site after login. What is the best classification?

Open redirect

SQL Injection

Session fixation

DOM clobbering

None

12.

Which response header most directly helps prevent your site from being embedded in a malicious iframe?

Content-Security-Policy: frame-ancestors 'self'

X-Content-Type-Options: nosniff

Strict-Transport-Security

Referrer-Policy: no-referrer

None

13.

A session cookie is missing the HttpOnly attribute. What is the practical risk?

JavaScript on the page can read the cookie if XSS exists

The cookie cannot be sent over HTTPS

The browser will reject the cookie on POST requests

The cookie automatically expires in 24 hours

None

14.

Which cookie attribute helps browsers withhold cookies on cross-site POST requests such as forged form submissions?

SameSite=Lax or SameSite=Strict

Domain=.example.com

Path=/api

Expires=Session

None

15.

A login query is built as "SELECT * FROM users WHERE email = '" + email + "'". What is the correct fix?

Use parameterized queries / prepared statements

HTML-encode the email before querying

Store the email in localStorage instead of the database

Hash the email with MD5 before concatenation

None

16.

A download endpoint serves /files?path=report.pdf but also accepts ../../../../etc/passwd. What vulnerability is this?

Path traversal / local file inclusion

Cross-Site Request Forgery (CSRF)

HTTP request smuggling

Race condition

None

17.

An XML upload endpoint parses external entities in user-supplied XML. Which class of bug is most likely?

XML External Entity (XXE) injection

Cross-Site Scripting (XSS)

Server-Side Template Injection (SSTI)

HTTP parameter pollution

None

18.

A login form reflects the username in the error message: Invalid password for admin. What testing goal does this support?

Username enumeration

Server-Side Request Forgery (SSRF)

XML External Entity (XXE)

DOM-based XSS only

None

19.

An API returns HTTP 200 with {"role":"user"} for your account, but changing role to admin in the JSON response makes the UI show admin menus. What is the flaw?

Trusting client-side or tamperable response data for authorization

SQL Injection

Clickjacking

Missing HSTS

None

Time's up