CREST Network & Web Application Security 2

Question 1

An attacker sends a crafted HTTP request with a 'Transfer-Encoding: chunked' header alongside a 'Content-Length' header to a server behind a reverse proxy. What attack is being attempted?

Accepted Answer

HTTP Request Smuggling

Answer

HTTP Request Smuggling exploits ambiguity between front-end and back-end servers in how they parse conflicting Transfer-Encoding and Content-Length headers.

Question 2

During a CREST assessment, you discover an endpoint reflects user input in a JSON response with Content-Type: application/json. Which vulnerability is LEAST likely to be exploitable via this reflection?

Accepted Answer

Stored XSS via JSON injection

Answer

Stored XSS requires persistence on the server; a reflection in a JSON response alone without unsafe DOM consumption is not stored and thus not stored XSS.

Question 3

A TCP port scan with Nmap returns a port state of 'filtered'. What does this indicate?

Accepted Answer

A firewall is dropping packets without sending a response

Answer

A 'filtered' state means Nmap received no response (packets silently dropped by a firewall or filter), unlike 'closed' which returns an RST.

Question 4

Which OWASP Top 10 category covers insecure use of cryptographic functions such as using MD5 to hash passwords?

Accepted Answer

Cryptographic Failures

Answer

OWASP Cryptographic Failures (formerly Sensitive Data Exposure) covers weak or misused cryptography including broken hash algorithms like MD5 for passwords.

Question 5

During a web application test, you find that the application uses JWT tokens. The decoded header shows 'alg: none'. What is the security implication?

Accepted Answer

The server may accept unsigned tokens, allowing arbitrary claim forgery

Answer

The 'none' algorithm in JWT means no signature is applied; vulnerable servers that accept this skip verification, allowing attackers to forge any claims.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Network & Web Application Security 2