Ethical Hacking Web Application Security 3

Question 1

What is 'HTTP response splitting' in web application security?

Accepted Answer

Injecting CRLF characters into headers to manipulate HTTP responses

Answer

HTTP response splitting injects CRLF (carriage return/line feed) characters into HTTP headers, allowing attackers to control response content and enable XSS or cache poisoning.

Question 2

Which authentication attack uses precomputed hash tables to reverse password hashes?

Accepted Answer

Rainbow table attack

Answer

Rainbow table attacks use precomputed tables of password-hash pairs to reverse cryptographic hashes quickly, far faster than brute-force cracking.

Question 3

What does SSRF stand for and why is it dangerous?

Accepted Answer

Server-Side Request Forgery — allows attackers to make the server request internal resources

Answer

Server-Side Request Forgery (SSRF) tricks the server into making HTTP requests to internal resources, potentially exposing cloud metadata, internal services, or enabling port scanning.

Question 4

Which tool is used to test web application security by fuzzing HTTP parameters and headers?

Accepted Answer

Wfuzz

Answer

Wfuzz is a web application fuzzer that tests parameters, headers, forms, and URLs by substituting payloads from wordlists to discover vulnerabilities.

Question 5

What is 'HTTP verb tampering' in web security testing?

Accepted Answer

Sending unexpected HTTP methods like PUT or DELETE to bypass access controls

Answer

HTTP verb tampering sends unusual HTTP methods (PUT, DELETE, PATCH) to web endpoints to bypass access controls that only restrict GET or POST requests.

Ethical Hacking Practice Test

Ethical Hacking Practice Test

Ethical Hacking Web Application Security 3