eJPT Web Application Security & Testing 4 — Questions and Answers
Question 1: What type of attack involves an adversary tricking a user's authenticated browser into submitting an unwanted request to a web application?
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF) (Correct answer)
- Session Hijacking
- Clickjacking
Correct answer: Cross-Site Request Forgery (CSRF)
CSRF exploits the trust a web application has in the user's browser, causing it to send authenticated state-changing requests without the user's knowledge.
Question 2: During a black-box web assessment, you observe that the application appends user input directly to a shell command. Which vulnerability class does this represent?
- Path traversal
- OS command injection (Correct answer)
- SSTI
- XXE injection
Correct answer: OS command injection
OS command injection occurs when unsanitized user input is incorporated into a system command, allowing attackers to execute arbitrary OS-level commands.
Question 3: Which encoding technique is commonly used to obfuscate XSS payloads and bypass basic input filters?
- Base64 encoding the entire payload
- HTML entity encoding attack characters
- URL encoding special characters
- All of the above can be used depending on the context (Correct answer)
Correct answer: All of the above can be used depending on the context
Attackers use Base64, HTML entities, URL encoding, and combinations thereof depending on where the payload is reflected and what filters are in place.
Question 4: What is the key difference between reflected XSS and stored XSS from an impact perspective?
- Reflected XSS is server-side; stored XSS is client-side
- Stored XSS can attack multiple users automatically; reflected XSS requires tricking individual users into clicking a link (Correct answer)
- Reflected XSS persists in the database; stored XSS does not
- Stored XSS only works on authenticated users
Correct answer: Stored XSS can attack multiple users automatically; reflected XSS requires tricking individual users into clicking a link
Stored XSS is more dangerous at scale because every user who visits the infected page is attacked automatically, whereas reflected XSS requires delivering a crafted link to each victim.
Question 5: Which Burp Suite feature is best suited for discovering hidden parameters and values through automated fuzzing?
- Burp Scanner
- Burp Intruder (Correct answer)
- Burp Decoder
- Burp Comparer
Correct answer: Burp Intruder
Burp Intruder automates customizable attack patterns against HTTP requests, making it ideal for fuzzing parameter values, discovering injection points, and brute-forcing inputs.
Question 6: A web application is vulnerable to XML External Entity (XXE) injection. Which of the following is a direct consequence?
- Attackers can steal CSRF tokens from other users
- Attackers can read arbitrary files on the server or perform SSRF (Correct answer)
- Attackers can inject JavaScript into XML responses
- Attackers can overwrite the server's XML configuration files
Correct answer: Attackers can read arbitrary files on the server or perform SSRF
XXE allows attackers to define external entities in XML that reference local file paths or internal URLs, enabling file disclosure and server-side request forgery.
Question 7: What does 'security misconfiguration' refer to in the OWASP Top 10 context, as relevant to web application testing?
- Using outdated cryptographic algorithms in TLS
- Improperly configured permissions, defaults, or settings that expose the application to attack (Correct answer)
- Failing to validate user-uploaded file types
- Storing passwords in plain text in the database
Correct answer: Improperly configured permissions, defaults, or settings that expose the application to attack
Security misconfiguration covers a broad category of issues including default credentials, open cloud storage, verbose error messages, unnecessary features enabled, and missing security headers.
eJPT Web Application Security & Testing 4
What type of attack involves an adversary tricking a user's authenticated browser into submitting an unwanted request to a web application?