eJPT Web Application Security & Testing 2

Question 1

Which HTTP response header helps prevent clickjacking attacks by controlling whether a browser can render a page in an iframe?

Accepted Answer

X-Frame-Options

Answer

X-Frame-Options with values DENY or SAMEORIGIN prevents the page from being embedded in iframes on other origins, mitigating clickjacking.

Question 2

During a web application test, you discover that user input is reflected directly into a JavaScript variable without sanitization. What vulnerability is most likely present?

Accepted Answer

DOM-based XSS

Answer

When user input is unsafely placed into JavaScript context without encoding, DOM-based XSS can occur as the payload is processed by the browser's JavaScript engine.

Question 3

What is the primary purpose of the Burp Suite Repeater module during web application testing?

Accepted Answer

Manually resend and modify individual HTTP requests

Answer

Burp Repeater lets a tester manually modify and resend individual HTTP requests to observe how the server responds to specific changes.

Question 4

Which SQL injection technique retrieves data by causing the application to make DNS or HTTP requests to an attacker-controlled server?

Accepted Answer

Out-of-band injection

Answer

Out-of-band SQL injection exfiltrates data through a separate channel such as DNS lookups or HTTP requests, useful when in-band responses aren't available.

Question 5

A web application stores session tokens in a cookie without the HttpOnly flag. What attack does this primarily enable?

Accepted Answer

Cookie theft via XSS

Answer

Without HttpOnly, JavaScript can read the cookie value, so a successful XSS attack can steal the session token and hijack the user's session.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Web Application Security & Testing 2