OSCP Web Application Attacks 2 — Questions and Answers
Question 1: What is the primary goal of directory traversal attacks in web application penetration testing?
- Injecting scripts into the web page
- Accessing files and directories outside the web root by manipulating file path variables (Correct answer)
- Brute-forcing web application passwords
- Enumerating all web server directories
Correct answer: Accessing files and directories outside the web root by manipulating file path variables
Directory traversal (path traversal) exploits insufficient input validation to access files outside the intended directory, such as reading /etc/passwd on Linux.
Question 2: What does a 'web shell' provide an attacker after successful web application exploitation?
- A GUI interface on the target
- Remote command execution through an HTTP/HTTPS channel (Correct answer)
- VPN access to the internal network
- Access to the database only
Correct answer: Remote command execution through an HTTP/HTTPS channel
A web shell is a script uploaded to a compromised web server that provides remote command execution capabilities over HTTP, acting as a backdoor accessible via a browser.
Question 3: During OSCP, you find a web application with an unrestricted file upload. What is the most effective way to exploit this?
- Upload a .txt file to check for path traversal
- Upload a malicious web shell script in a language the server executes (Correct answer)
- Upload a large file to cause a denial of service
- Use a cross-site request forgery to redirect uploads
Correct answer: Upload a malicious web shell script in a language the server executes
Unrestricted file upload vulnerabilities are best exploited by uploading a web shell (e.g., PHP shell on PHP servers) that can then be accessed to execute commands.
Question 4: What is the difference between reflected and stored Cross-Site Scripting (XSS)?
- Reflected XSS is server-side; stored XSS is client-side
- Reflected XSS is returned immediately in a response; stored XSS is saved and executed later for all visitors (Correct answer)
- Reflected XSS affects databases; stored XSS affects cookies only
- There is no meaningful difference between the two types
Correct answer: Reflected XSS is returned immediately in a response; stored XSS is saved and executed later for all visitors
Reflected XSS requires the victim to click a malicious link, while stored XSS persists in the application (e.g., a database) and executes for every user who views the affected page.
Question 5: What Nikto command would you use to scan a web server at 192.168.1.10 on port 8080?
- nikto -host 192.168.1.10 -port 8080
- nikto -h 192.168.1.10 -p 8080 (Correct answer)
- nikto --target 192.168.1.10:8080
- nikto -scan 192.168.1.10 8080
Correct answer: nikto -h 192.168.1.10 -p 8080
The correct Nikto syntax uses -h for the host and -p for the port, so 'nikto -h 192.168.1.10 -p 8080' scans the specified host and port for common vulnerabilities.
Question 6: What is XML External Entity (XXE) injection and what can it be used for in OSCP?
- Injecting XML tags to break application logic
- Exploiting XML parsers to read local files, perform SSRF, or execute code (Correct answer)
- Encrypting XML data with malicious payloads
- Overriding XML schemas to bypass authentication
Correct answer: Exploiting XML parsers to read local files, perform SSRF, or execute code
XXE injection exploits XML processors that allow external entity references, enabling attackers to read local files, probe internal services, or in some cases achieve remote code execution.
OSCP Web Application Attacks 2
What is the primary goal of directory traversal attacks in web application penetration testing?