Ethical Hacking Web Application Security 2

Question 1

Which tool is commonly used by penetration testers for automated SQL injection detection and exploitation?

Accepted Answer

SQLMap

Answer

SQLMap is an open-source tool that automatically detects and exploits SQL injection vulnerabilities in web applications, supporting various database backends.

Question 2

What is 'clickjacking' in web application security?

Accepted Answer

Embedding a target page in an iframe to trick users into clicking hidden elements

Answer

Clickjacking overlays an invisible iframe of a legitimate site over a decoy page, tricking users into clicking elements on the target site without their knowledge.

Question 3

Which type of XSS permanently stores malicious script in the target server's database?

Accepted Answer

Stored XSS

Answer

Stored XSS (persistent XSS) saves malicious scripts in server-side storage like databases, which are then served to all users who view the affected page.

Question 4

What does IDOR stand for in web security testing?

Accepted Answer

Insecure Direct Object Reference

Answer

Insecure Direct Object Reference (IDOR) occurs when an application exposes internal object references (IDs) without access control checks, allowing unauthorized data access.

Question 5

Which tool is used to brute force hidden directories and files on a web server?

Accepted Answer

Gobuster

Answer

Gobuster performs brute-force enumeration of directories, files, and DNS subdomains using wordlists, helping testers find hidden content on web servers.

Ethical Hacking Practice Test

Ethical Hacking Practice Test

Ethical Hacking Web Application Security 2