eJPT Web Application Security & Testing 3 — Questions and Answers
Question 1: What does the term 'stored XSS' mean in the context of web application security?
- The malicious script is stored in the URL fragment
- The malicious script is persisted in the application's database and served to other users (Correct answer)
- The XSS payload is stored in the browser's local storage
- The attack exploits stored procedures in the database
Correct answer: The malicious script is persisted in the application's database and served to other users
Stored (persistent) XSS occurs when user-supplied malicious script is saved server-side and later rendered in other users' browsers without proper encoding.
Question 2: Which tool is commonly used for automated directory and file brute-forcing on web servers?
- Metasploit
- Gobuster (Correct answer)
- Wireshark
- Nessus
Correct answer: Gobuster
Gobuster performs fast directory/file enumeration against web servers using wordlists, helping testers discover hidden endpoints and resources.
Question 3: During a penetration test, you find a login form that returns 'Invalid username' for nonexistent users and 'Invalid password' for valid ones. What vulnerability is this?
- Brute force vulnerability
- Username enumeration (Correct answer)
- Credential stuffing
- Authentication bypass
Correct answer: Username enumeration
Differential error messages reveal whether a username exists, allowing attackers to enumerate valid accounts before attempting password attacks.
Question 4: Which HTTP method, if enabled unnecessarily on a web server, can allow an attacker to upload malicious files?
- GET
- PUT (Correct answer)
- HEAD
- OPTIONS
Correct answer: PUT
The HTTP PUT method is designed for uploading file content to a server; if enabled without authentication, attackers can place malicious files like web shells.
Question 5: What is the role of a web application firewall (WAF) bypass technique during a penetration test?
- Exploit the WAF's administrative interface
- Craft payloads that evade the WAF's signature matching to reach the back-end application (Correct answer)
- Extract the WAF's rule set via SQL injection
- Use the WAF's logs to identify other vulnerabilities
Correct answer: Craft payloads that evade the WAF's signature matching to reach the back-end application
WAF bypass involves encoding, obfuscating, or fragmenting attack payloads so they are not matched by the WAF's rules while still being interpreted maliciously by the back-end.
Question 6: In web application testing, what is 'parameter pollution' (HPP)?
- Injecting null bytes into parameters to terminate strings
- Supplying duplicate HTTP parameters to confuse parsing logic and bypass filters (Correct answer)
- Adding extra headers to override server-side variables
- Encoding parameters in an unexpected charset to bypass input validation
Correct answer: Supplying duplicate HTTP parameters to confuse parsing logic and bypass filters
HTTP Parameter Pollution (HPP) sends multiple values for the same parameter; inconsistent parsing between front-end and back-end can lead to filter bypass or logic flaws.
Question 7: Which of the following is an example of an Insecure Direct Object Reference (IDOR) vulnerability?
- A login page that doesn't lock out after failed attempts
- Accessing another user's invoice by changing the ID in the URL from 101 to 102 (Correct answer)
- Injecting SQL into a search field to dump the database
- Uploading a PHP shell disguised as an image
Correct answer: Accessing another user's invoice by changing the ID in the URL from 101 to 102
IDOR occurs when an application exposes internal object references (like database IDs) in URLs without verifying that the requesting user is authorized to access the referenced object.
eJPT Web Application Security & Testing 3
What does the term 'stored XSS' mean in the context of web application security?