Quiz · OWASP CTF in a Box

Which risk is #1 in both the OWASP Top 10 2021 and 2025?

3 of 3 attempts left10 pts

InjectionBroken Access ControlCryptographic FailuresServer-Side Request Forgery

Changing /api/invoices/1042 to /api/invoices/1041 shows another customer's invoice. What is this?

3 of 3 attempts left10 pts

Insecure direct object reference (broken access control)Cross-site scriptingClickjackingOpen redirect

What does XSS stand for?

3 of 3 attempts left50 pts

Cross-Site ScriptingXML Signature ExchangeCross-Server XchangeExtended Session Storage

Which of these are injection vulnerabilities? (choose all that apply)

3 of 3 attempts left100 pts

SQL InjectionCommand InjectionCross-Site ScriptingBroken Access Control

Which of these actually prevent SQL injection?

3 of 3 attempts left30 pts

Parameterised queries / prepared statementsAn allow-list for identifiers such as an ORDER BY columnEscaping quotes with addslashes() aloneValidating input only in client-side JavaScriptA stored procedure that concatenates its arguments into dynamic SQL

Which OWASP Top 10 (2021) category covers broken access control?

3 of 3 attempts left50 pts

A01:2021A03:2021A05:2021A07:2021

How should an application store user passwords?

3 of 3 attempts left20 pts

SHA-256 of the passwordAES-encrypted with a key in the config fileA slow, salted password hash such as Argon2id, scrypt or bcryptMD5 with one global salt

Which HTTP response headers help mitigate common web attacks? (choose all that apply)

3 of 3 attempts left100 pts

Content-Security-PolicyX-Frame-OptionsSet-CookieStrict-Transport-Security

Which are software supply chain failures (OWASP Top 10 2025 A03)?

3 of 3 attempts left30 pts

Installing a typo-squatted package (lodahs for lodash)A GitHub Action referenced by a moving tag such as @mainA compromised CI runner that injects code into the buildReflected XSS in a search boxA missing HttpOnly flag on a session cookie

What is the primary defense against CSRF attacks?

3 of 3 attempts left75 pts

Anti-CSRF tokensRate limitingPassword hashingCORS headers

An app fetches any URL the user supplies, and an attacker points it at http://169.254.169.254/latest/meta-data/. Which vulnerability is this?

3 of 3 attempts left20 pts

CSRFServer-side request forgery (SSRF)XXEPath traversal

What does SameSite=Lax on a session cookie mainly defend against?

3 of 3 attempts left20 pts

Cross-site request forgerySQL injectionSession fixation via URLCredential stuffing

Which should never be written to application logs?

3 of 3 attempts left20 pts

Session tokensPasswords, even failed onesThe time of a failed loginThe user id that failed to log in

Which response header limits the damage of an XSS bug by restricting where scripts can load from?

3 of 3 attempts left20 pts

X-Content-Type-OptionsStrict-Transport-SecurityContent-Security-PolicyReferrer-Policy

In this kit's Secure Development module, what must a stock, unpatched app score?

3 of 3 attempts left20 pts

0Half the pointsWhatever the last contestant scoredIt isn't scored