eJPT Web Application Security & Testing 5 — Questions and Answers
Question 1: When performing a web application penetration test, you find the application uses JWT tokens for authentication. What is a common vulnerability to test for?
- Using the 'none' algorithm to bypass signature verification (Correct answer)
- Brute-forcing the JWT expiration timestamp
- Injecting SQL into the JWT header
- Performing a replay attack using the JWT secret
Correct answer: Using the 'none' algorithm to bypass signature verification
Some JWT libraries accept 'alg: none', removing the signature requirement entirely, allowing attackers to forge tokens by setting the algorithm to none and stripping the signature.
Question 2: Which technique can be used to test for blind SQL injection when the application produces no visible error messages?
- Using UNION SELECT to retrieve database version
- Sending time-delay payloads like SLEEP() or WAITFOR DELAY (Correct answer)
- Appending a comment character to terminate the query
- Extracting data through verbose error messages
Correct answer: Sending time-delay payloads like SLEEP() or WAITFOR DELAY
Time-based blind SQL injection uses conditional delay functions (e.g., SLEEP(5)) to infer true/false conditions from how long the server takes to respond.
Question 3: What is 'subdomain takeover' in the context of web application security testing?
- Hijacking a session by stealing subdomain-scoped cookies
- Claiming an abandoned subdomain's external resource to serve malicious content under the target's domain (Correct answer)
- Using DNS zone transfer to enumerate all subdomains
- Redirecting traffic from a subdomain using a CSRF attack
Correct answer: Claiming an abandoned subdomain's external resource to serve malicious content under the target's domain
Subdomain takeover occurs when a DNS CNAME points to an external service that has been deprovisioned; an attacker can register that service and serve content under the victim's subdomain.
Question 4: In a web application test, which HTTP status code suggests that a resource exists but is intentionally hidden or restricted, as opposed to truly not existing?
- 404 Not Found
- 403 Forbidden (Correct answer)
- 301 Moved Permanently
- 500 Internal Server Error
Correct answer: 403 Forbidden
A 403 Forbidden response confirms the resource exists but access is denied, making it a valuable signal during directory enumeration that something interesting may be behind the restriction.
Question 5: What is the primary goal of testing for 'business logic flaws' in web applications?
- Finding SQL injection vulnerabilities in business-critical workflows
- Discovering ways to abuse legitimate application functionality to achieve unintended outcomes (Correct answer)
- Testing that the application enforces TLS on all business transactions
- Verifying that the application logs all user actions correctly
Correct answer: Discovering ways to abuse legitimate application functionality to achieve unintended outcomes
Business logic flaws involve exploiting the intended workflow of an application — such as skipping payment steps or applying discounts multiple times — rather than technical injection vulnerabilities.
Question 6: During reconnaissance on a web application, which technique involves looking at the website's source HTML, JavaScript files, and comments for sensitive information?
- Active scanning
- Passive information gathering (Correct answer)
- Credential stuffing
- Banner grabbing
Correct answer: Passive information gathering
Passive information gathering from client-side assets like HTML comments, JS files, and metadata can reveal API keys, internal URLs, developer notes, and hidden endpoints without sending active attack traffic.
Question 7: Which of the following payloads is most indicative of a Server-Side Template Injection (SSTI) vulnerability?
- ' OR '1'='1
- {{7*7}} rendering as 49 in the response (Correct answer)
- <script>alert(1)</script>
- ../../../etc/passwd
Correct answer: {{7*7}} rendering as 49 in the response
If the expression {{7*7}} is evaluated and returns 49 in the server's response, it confirms the template engine is executing user-supplied input, indicating SSTI.
eJPT Web Application Security & Testing 5
When performing a web application penetration test, you find the application uses JWT tokens for authentication.
What is a common vulnerability to test for?