GCIH Web Application Security & Attacks 2

Question 1

What is a Local File Inclusion (LFI) vulnerability, and what risk does it pose to a web server?

Accepted Answer

It allows attackers to include and read files from the server's local filesystem through a web parameter

Answer

LFI allows attackers to manipulate file path parameters in web applications to include files from the server's local filesystem, potentially exposing sensitive data or enabling code execution.

Question 2

An attacker appends '../../../etc/passwd' to a URL parameter in a web request. What attack type is being attempted?

Accepted Answer

Directory Traversal

Answer

Directory traversal (path traversal) uses '../' sequences to navigate outside the intended web root and access restricted files on the underlying server filesystem.

Question 3

What type of attack captures a valid authenticated session token and reuses it to impersonate the legitimate user without needing their credentials?

Accepted Answer

Session hijacking

Answer

Session hijacking involves stealing a valid session token via XSS, network sniffing, or other means and using it to take over an authenticated user's session.

Question 4

An XML-based web service parses user-supplied XML that references external entities. What vulnerability does this create?

Accepted Answer

XML External Entity (XXE) Injection

Answer

XXE (XML External Entity) injection allows attackers to define external entities in XML that can read local files, perform server-side request forgery (SSRF), or cause denial of service.

Question 5

Which technique do attackers commonly use to bypass blacklist-based input validation filters that block known malicious strings?

Accepted Answer

Obfuscation and encoding such as URL encoding or double encoding

Answer

Blacklist filters can often be evaded by encoding malicious characters as URL-encoded, double-encoded, or HTML entity representations that bypass pattern matching but are later decoded and interpreted.

(GCIH) GIAC Experienced Incident Handler Practice Test

(GCIH) GIAC Experienced Incident Handler Practice Test

GCIH Web Application Security & Attacks 2