OSCP Web Application Attacks 2

Question 1

What is the primary goal of directory traversal attacks in web application penetration testing?

Accepted Answer

Accessing files and directories outside the web root by manipulating file path variables

Answer

Injecting scripts into the web page

Answer

Brute-forcing web application passwords

Answer

Enumerating all web server directories

Question 2

What does a 'web shell' provide an attacker after successful web application exploitation?

Accepted Answer

Remote command execution through an HTTP/HTTPS channel

Answer

A GUI interface on the target

Answer

VPN access to the internal network

Answer

Access to the database only

Question 3

During OSCP, you find a web application with an unrestricted file upload. What is the most effective way to exploit this?

Accepted Answer

Upload a malicious web shell script in a language the server executes

Answer

Upload a .txt file to check for path traversal

Answer

Upload a large file to cause a denial of service

Answer

Use a cross-site request forgery to redirect uploads

Question 4

What is the difference between reflected and stored Cross-Site Scripting (XSS)?

Accepted Answer

Reflected XSS is returned immediately in a response; stored XSS is saved and executed later for all visitors

Answer

Reflected XSS is server-side; stored XSS is client-side

Answer

Reflected XSS affects databases; stored XSS affects cookies only

Answer

There is no meaningful difference between the two types

Question 5

What Nikto command would you use to scan a web server at 192.168.1.10 on port 8080?

Accepted Answer

nikto -h 192.168.1.10 -p 8080

Answer

nikto -host 192.168.1.10 -port 8080

Answer

nikto --target 192.168.1.10:8080

Answer

nikto -scan 192.168.1.10 8080

Question 6

What is XML External Entity (XXE) injection and what can it be used for in OSCP?

Accepted Answer

Exploiting XML parsers to read local files, perform SSRF, or execute code

Answer

Injecting XML tags to break application logic

Answer

Encrypting XML data with malicious payloads

Answer

Overriding XML schemas to bypass authentication