eJPT Web Application Security & Testing 2 — Questions and Answers
Question 1: Which HTTP response header helps prevent clickjacking attacks by controlling whether a browser can render a page in an iframe?
- Content-Security-Policy
- X-Frame-Options (Correct answer)
- Strict-Transport-Security
- X-Content-Type-Options
Correct answer: X-Frame-Options
X-Frame-Options with values DENY or SAMEORIGIN prevents the page from being embedded in iframes on other origins, mitigating clickjacking.
Question 2: During a web application test, you discover that user input is reflected directly into a JavaScript variable without sanitization. What vulnerability is most likely present?
- SQL Injection
- DOM-based XSS (Correct answer)
- CSRF
- Path Traversal
Correct answer: DOM-based XSS
When user input is unsafely placed into JavaScript context without encoding, DOM-based XSS can occur as the payload is processed by the browser's JavaScript engine.
Question 3: What is the primary purpose of the Burp Suite Repeater module during web application testing?
- Automatically scan for vulnerabilities
- Manually resend and modify individual HTTP requests (Correct answer)
- Intercept and drop requests in real time
- Fuzz parameters with a wordlist
Correct answer: Manually resend and modify individual HTTP requests
Burp Repeater lets a tester manually modify and resend individual HTTP requests to observe how the server responds to specific changes.
Question 4: Which SQL injection technique retrieves data by causing the application to make DNS or HTTP requests to an attacker-controlled server?
- Error-based injection
- Union-based injection
- Out-of-band injection (Correct answer)
- Boolean-based blind injection
Correct answer: Out-of-band injection
Out-of-band SQL injection exfiltrates data through a separate channel such as DNS lookups or HTTP requests, useful when in-band responses aren't available.
Question 5: A web application stores session tokens in a cookie without the HttpOnly flag. What attack does this primarily enable?
- CSRF attacks
- Cookie theft via XSS (Correct answer)
- Session fixation
- Clickjacking
Correct answer: Cookie theft via XSS
Without HttpOnly, JavaScript can read the cookie value, so a successful XSS attack can steal the session token and hijack the user's session.
Question 6: When testing for Local File Inclusion (LFI), which file on a Linux system is most commonly targeted to verify the vulnerability?
- /etc/shadow
- /etc/passwd (Correct answer)
- /proc/self/environ
- /var/log/auth.log
Correct answer: /etc/passwd
/etc/passwd is world-readable on Linux and its distinctive format makes it an ideal proof-of-concept target when confirming LFI vulnerabilities.
Question 7: Which of the following best describes a Server-Side Request Forgery (SSRF) vulnerability?
- An attacker forces a user's browser to send requests to another site
- An attacker causes the server to make HTTP requests to arbitrary internal or external resources (Correct answer)
- An attacker injects server-side scripts into file upload fields
- An attacker replaces a legitimate URL in a response with a malicious one
Correct answer: An attacker causes the server to make HTTP requests to arbitrary internal or external resources
SSRF tricks the server into issuing requests on the attacker's behalf, often enabling access to internal services that are otherwise unreachable from the internet.
eJPT Web Application Security & Testing 2
Which HTTP response header helps prevent clickjacking attacks by controlling whether a browser can render a page in an iframe?