CREST Network & Web Application Security 3 — Questions and Answers
Question 1: Which technique does an attacker use to bypass WAF signature-based XSS detection by encoding the payload as HTML entities within a JavaScript event handler?
- Obfuscation through entity encoding (Correct answer)
- Polyglot injection
- DOM clobbering
- Prototype pollution
Correct answer: Obfuscation through entity encoding
HTML entity encoding within event handlers (e.g., <img onerror=alert(1)>) can bypass WAF string-matching rules while browsers still decode and execute the payload.
Question 2: In the context of TLS security, what does the term 'cipher suite downgrade attack' refer to?
- Manipulating the handshake to force negotiation of a weaker cipher suite both parties support (Correct answer)
- Breaking the pre-master secret by brute force
- Forging a TLS certificate to intercept traffic
- Replaying captured TLS session tickets
Correct answer: Manipulating the handshake to force negotiation of a weaker cipher suite both parties support
A downgrade attack manipulates the ClientHello/ServerHello exchange to negotiate a weaker (potentially broken) cipher suite that both endpoints advertise as supported.
Question 3: A CREST tester observes that an application sets cookies without any flags. Which combination of flags should be recommended to mitigate session hijacking and XSS-based cookie theft?
- Secure; HttpOnly; SameSite=Strict (Correct answer)
- Secure; Path=/
- HttpOnly; Domain=.example.com
- SameSite=None; Secure
Correct answer: Secure; HttpOnly; SameSite=Strict
Secure prevents transmission over HTTP, HttpOnly blocks JavaScript access, and SameSite=Strict prevents CSRF-based session abuse together providing comprehensive session cookie protection.
Question 4: Which port and protocol combination is associated with SMB (Server Message Block) on modern Windows systems?
- TCP 445 (Correct answer)
- UDP 137
- TCP 139
- UDP 138
Correct answer: TCP 445
Modern SMB (SMBv2/v3) operates directly over TCP port 445, while NetBIOS-based legacy SMB used TCP 139 and UDP 137/138.
Question 5: When testing for LDAP injection, which characters should a tester attempt to inject to break out of filter expressions?
- Parentheses, asterisks, and backslashes: ( ) * \ (Correct answer)
- Single quotes and double dashes: ' --
- Angle brackets and ampersands: < > &
- Semicolons and URL-encoded null bytes: ; %00
Correct answer: Parentheses, asterisks, and backslashes: ( ) * \
LDAP filter syntax uses parentheses to delimit expressions, asterisks as wildcards, and backslashes for escaping, making these the primary injection characters.
Question 6: What is the primary difference between a vulnerability scan and a penetration test?
- A vulnerability scan identifies potential weaknesses automatically, while a penetration test actively exploits them to demonstrate real-world impact (Correct answer)
- A vulnerability scan is manual and a penetration test is automated
- A vulnerability scan requires source code access, while a penetration test does not
- A penetration test only targets network infrastructure, while a vulnerability scan covers applications too
Correct answer: A vulnerability scan identifies potential weaknesses automatically, while a penetration test actively exploits them to demonstrate real-world impact
Vulnerability scanning is automated discovery of known weaknesses; penetration testing goes further by chaining and exploiting vulnerabilities to prove actual business impact.
Question 7: An attacker intercepts a request to reset a password that contains a token in the URL. They modify the 'Host' header to their controlled domain and forward the request. What attack is this?
- Host Header Injection for password reset poisoning (Correct answer)
- Open Redirect exploitation
- Clickjacking via frame injection
- CSRF token bypass
Correct answer: Host Header Injection for password reset poisoning
Password reset poisoning via Host Header Injection tricks the application into generating a reset link pointing to the attacker's domain, delivered to the victim's email.
CREST Network & Web Application Security 3
Which technique does an attacker use to bypass WAF signature-based XSS detection by encoding the payload as HTML entities within a JavaScript event handler?