Blog

A web application includes the following code to handle search queries: app.get(“/search”, (req, res) => {    const q = req.query.q;    res.send(`You searched for: ${q}`);}); The developer claims the page is safe because it “does not interact with the database.”What is the primary security risk in this endpoint?

A page at evil.com loads: Short Answer (80 words): Explain how the defender could protect the system against the attacker, preventing him from reading the iframe contents, even though the victim is logged in.

Page code:                    res.send(`${req.query.q}`); Cookies:                    sessionID=abc123; SameSite=None; Secure The developer claims session theft is impossible because the cookie is “Secure” and “SameSite=None”.Which attacker-supplied payloads will successfully steal the victim’s sessionID cookie when the victim clicks the malicious link?(Select all that apply)

Consider: POST /api/profile/updateBody: { name, email, state } Which STRIDE category applies when a malicious user modifies another user’s profile by guessing their user ID?

Given: Which vulnerabilities exist? (Select all that apply)

Page code:                    res.send(`${req.query.q}`); Cookies:                    sessionID=abc123; SameSite=None; Secure The developer claims session theft is impossible because the cookie is “Secure” and “SameSite=None”.Which attacker-supplied payloads will successfully steal the victim’s sessionID cookie when the victim clicks the malicious link?(Select all that apply)

Given: Which vulnerabilities exist? (Select all that apply)

The query is: SELECT id FROM users WHERE email LIKE ‘%${q}%’ AND active=1; Which UNION payloads correctly extract other columns? (Select all that apply)

The query is: SELECT id FROM users WHERE email LIKE ‘%${q}%’ AND active=1; Which UNION payloads correctly extract other columns? (Select all that apply)

2×3=