` into a search field on a web application. The subsequent results page immediately executes the script, and an alert box appears. The script is not stored on the server in any permanent way. What type of Cross-Site Scripting (XSS) vulnerability has been identified?","acceptedAnswer":{"@type":"Answer","text":"Reflected XSS"},"suggestedAnswer":[{"@type":"Answer","text":"Stored XSS"},{"@type":"Answer","text":"DOM-based XSS"},{"@type":"Answer","text":"Server-Side XSS"}]},{"@type":"Question","position":2,"name":"A penetration tester needs to discover hidden directories and files on a web server by using a wordlist to brute-force common names. Which of the following command-line tools is specifically designed for this purpose and is known for its speed?","acceptedAnswer":{"@type":"Answer","text":"Gobuster"},"suggestedAnswer":[{"@type":"Answer","text":"Nmap"},{"@type":"Answer","text":"Wireshark"},{"@type":"Answer","text":"Metasploit"}]},{"@type":"Question","position":3,"name":"While testing a login form, a junior pentester enters `' OR 1=1 --` into the username field and a random string in the password field. They successfully bypass authentication and gain access to an account. This is a classic example of which vulnerability?","acceptedAnswer":{"@type":"Answer","text":"SQL Injection (SQLi)"},"suggestedAnswer":[{"@type":"Answer","text":"Cross-Site Scripting (XSS)"},{"@type":"Answer","text":"Cross-Site Request Forgery (CSRF)"},{"@type":"Answer","text":"Insecure Deserialization"}]},{"@type":"Question","position":4,"name":"Within Burp Suite, which tool is primarily used to act as a man-in-the-middle, allowing a tester to intercept, view, and modify all HTTP/S requests and responses between their browser and the target application in real-time?","acceptedAnswer":{"@type":"Answer","text":"Proxy"},"suggestedAnswer":[{"@type":"Answer","text":"Intruder"},{"@type":"Answer","text":"Repeater"},{"@type":"Answer","text":"Decoder"}]},{"@type":"Question","position":5,"name":"A tester discovers a URL `http://example.com/app/profile?view=user.php`. By changing the URL to `http://example.com/app/profile?view=../../../../etc/passwd`, the contents of the server's password file are displayed. Which vulnerability has been exploited?","acceptedAnswer":{"@type":"Answer","text":"Local File Inclusion (LFI)"},"suggestedAnswer":[{"@type":"Answer","text":"Server-Side Request Forgery (SSRF)"},{"@type":"Answer","text":"Remote File Inclusion (RFI)"},{"@type":"Answer","text":"Command Injection"}]},{"@type":"Question","position":6,"name":"Which of the following best describes the primary goal of a Cross-Site Request Forgery (CSRF) attack?","acceptedAnswer":{"@type":"Answer","text":"To trick an authenticated user's browser into sending an unintended, state-changing request to a web application."},"suggestedAnswer":[{"@type":"Answer","text":"To execute malicious scripts in the victim's browser to steal session cookies."},{"@type":"Answer","text":"To inject malicious SQL queries into a back-end database through user input fields."},{"@type":"Answer","text":"To include and execute a malicious file from a remote server within the context of the target application server."}]}]}
eJPT - eLearnSecurity Junior Penetration Tester Web Application Penetration Testing Questions and Answers — Questions and Answers
Question 1: A penetration tester inputs the string `<script>alert('XSS')</script>` into a search field on a web application. The subsequent results page immediately executes the script, and an alert box appears. The script is not stored on the server in any permanent way. What type of Cross-Site Scripting (XSS) vulnerability has been identified?
Stored XSS
Reflected XSS (Correct answer)
DOM-based XSS
Server-Side XSS
Correct answer: Reflected XSS
This is a Reflected XSS attack because the malicious script was sent to the web server as part of the request (in the search query) and was then immediately 'reflected' back and executed in the victim's browser without being permanently stored.
Question 2: A penetration tester needs to discover hidden directories and files on a web server by using a wordlist to brute-force common names. Which of the following command-line tools is specifically designed for this purpose and is known for its speed?
Nmap
Wireshark
Metasploit
Gobuster (Correct answer)
Correct answer: Gobuster
Gobuster is a tool written in Go that is used to brute-force URIs (directories and files), DNS subdomains, and virtual host names on web servers. Nmap is for network scanning, Wireshark is for packet analysis, and Metasploit is an exploitation framework.
Question 3: While testing a login form, a junior pentester enters `' OR 1=1 --` into the username field and a random string in the password field. They successfully bypass authentication and gain access to an account. This is a classic example of which vulnerability?
SQL Injection (SQLi) (Correct answer)
Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF)
Insecure Deserialization
Correct answer: SQL Injection (SQLi)
This is a classic SQL Injection (SQLi) attack. The injected string `' OR 1=1 --` modifies the backend SQL query so that the condition is always true, and the `--` comments out the rest of the query (like the password check), allowing the attacker to bypass authentication.
Question 4: Within Burp Suite, which tool is primarily used to act as a man-in-the-middle, allowing a tester to intercept, view, and modify all HTTP/S requests and responses between their browser and the target application in real-time?
Intruder
Repeater
Proxy (Correct answer)
Decoder
Correct answer: Proxy
The Burp Proxy tool is the core of Burp Suite and functions as an intercepting web proxy. It allows the user to intercept and modify traffic passing in both directions between the browser and the target server. Intruder is for automated attacks, Repeater is for manually re-sending and modifying individual requests, and Decoder is for data encoding/decoding.
Question 5: A tester discovers a URL `http://example.com/app/profile?view=user.php`. By changing the URL to `http://example.com/app/profile?view=../../../../etc/passwd`, the contents of the server's password file are displayed. Which vulnerability has been exploited?
Server-Side Request Forgery (SSRF)
Remote File Inclusion (RFI)
Command Injection
Local File Inclusion (LFI) (Correct answer)
Correct answer: Local File Inclusion (LFI)
This is a Local File Inclusion (LFI) vulnerability, often combined with a Path Traversal attack. The `../` sequence is used to navigate up the directory structure to access and display a sensitive file that exists locally on the server.
Question 6: Which of the following best describes the primary goal of a Cross-Site Request Forgery (CSRF) attack?
To execute malicious scripts in the victim's browser to steal session cookies.
To trick an authenticated user's browser into sending an unintended, state-changing request to a web application. (Correct answer)
To inject malicious SQL queries into a back-end database through user input fields.
To include and execute a malicious file from a remote server within the context of the target application server.
Correct answer: To trick an authenticated user's browser into sending an unintended, state-changing request to a web application.
The core of a CSRF attack is to force an authenticated user's browser to send a forged request to a web application, performing an unwanted action (like changing a password or transferring funds) by leveraging the user's active session.
eJPT - eLearnSecurity Junior Penetration Tester Web Application Penetration Testing Questions and Answers
A penetration tester inputs the string `alert('XSS')` into a search field on a web application. The subsequent results page immediately executes the script, and an alert box appears. The script is not stored on the server in any permanent way. What type of Cross-Site Scripting (XSS) vulnerability has been identified?
