eJPT Web Application Penetration Testing 4

Question 1

What is the difference between a 'whitebox' and 'blackbox' web application penetration test?

Accepted Answer

Whitebox provides the tester with source code and architecture details; blackbox gives no prior knowledge

Answer

In a whitebox test the tester has full knowledge (source code, diagrams, credentials), while a blackbox test simulates an external attacker with zero prior information.

Question 2

Which Burp Suite feature allows you to send a request to multiple payloads automatically, cycling through a wordlist?

Accepted Answer

Burp Intruder

Answer

Burp Intruder automates customized attacks by injecting payloads from a wordlist into marked positions within a request.

Question 3

What does the term 'parameter tampering' mean in web application security testing?

Accepted Answer

Intercepting and modifying HTTP parameters to alter application logic or access unauthorized data

Answer

Parameter tampering involves modifying HTTP parameters (query strings, form fields, cookies) to manipulate application behavior in ways the developer did not intend.

Question 4

You discover a web application that makes server-side HTTP requests to URLs specified by user input. Which vulnerability is this?

Accepted Answer

Server-Side Request Forgery (SSRF)

Answer

SSRF occurs when a server makes HTTP requests to attacker-controlled URLs, potentially allowing access to internal services or cloud metadata endpoints.

Question 5

Which HTTP status code typically indicates that a resource exists but the user is not authorized to view it, which can be useful during enumeration?

Accepted Answer

403 Forbidden

Answer

A 403 Forbidden response confirms the resource exists but access is denied, whereas 404 would suggest the resource doesn't exist — making 403 useful for confirming valid paths.

eLearnSecurity Junior Penetration Tester eJPT Practice Practice Test

eLearnSecurity Junior Penetration Tester eJPT Practice Practice Test

eJPT Web Application Penetration Testing 4