[&] Why is it important to analyze the structure of a cross-site scripting payload when bypassing filters?
- It ensures optimal performance of the web application
- It helps identify endpoints that might bypass server-side filters -- Correct
- It reduces the risk of detection by intrusion prevention systems
- It allows the reuse of exploits across multiple applications

[&] What role does URL encoding play in cross-site scripting attacks?
- It ensures payloads can be stored as ASCII text
- It increases the size of payloads to avoid detection
- It formats payloads to bypass input filters -- Correct
- It masks payloads from network traffic monitoring tools

[&] What is a potential signal of a successful cross-site scripting payload in a web application?
- The text on the page changes color
- The page takes longer to load
- The layout of the page changes slightly -- Correct
- The layout of the page remains unchanged

[&] What is a benefit of using a POC (Proof of Concept) exploit for cross-site scripting testing?
- It serves as a guideline for payload format requirements -- Correct
- It avoids the need for understanding server-side filters
- It simplifies the application protection process
- It guarantees exploitation in all scenarios

[&] Why might a user agent HTTP header be a target for cross-site scripting attacks?
- HTTP headers are not parsed by the server.
- They store sensitive user information.
- They might not have input filtering applied. -- Correct
- User agent headers are always accessible to attackers.

[&] How can Burp Suite aid in finding cross-site scripting vulnerabilities?
- By generating reports on all found vulnerabilities
- By intercepting and modifying HTTP requests -- Correct
- By decoding traffic to reveal encoded payloads
- By automatically exploiting vulnerabilities without user input