eJPT Web Application Security & Testing 4

Question 1

What type of attack involves an adversary tricking a user's authenticated browser into submitting an unwanted request to a web application?

Accepted Answer

Cross-Site Request Forgery (CSRF)

Answer

CSRF exploits the trust a web application has in the user's browser, causing it to send authenticated state-changing requests without the user's knowledge.

Question 2

During a black-box web assessment, you observe that the application appends user input directly to a shell command. Which vulnerability class does this represent?

Accepted Answer

OS command injection

Answer

OS command injection occurs when unsanitized user input is incorporated into a system command, allowing attackers to execute arbitrary OS-level commands.

Question 3

Which encoding technique is commonly used to obfuscate XSS payloads and bypass basic input filters?

Accepted Answer

All of the above can be used depending on the context

Answer

Attackers use Base64, HTML entities, URL encoding, and combinations thereof depending on where the payload is reflected and what filters are in place.

Question 4

What is the key difference between reflected XSS and stored XSS from an impact perspective?

Accepted Answer

Stored XSS can attack multiple users automatically; reflected XSS requires tricking individual users into clicking a link

Answer

Stored XSS is more dangerous at scale because every user who visits the infected page is attacked automatically, whereas reflected XSS requires delivering a crafted link to each victim.

Question 5

Which Burp Suite feature is best suited for discovering hidden parameters and values through automated fuzzing?

Accepted Answer

Burp Intruder

Answer

Burp Intruder automates customizable attack patterns against HTTP requests, making it ideal for fuzzing parameter values, discovering injection points, and brute-forcing inputs.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Web Application Security & Testing 4