"},{"@type":"Answer","text":"#!/bin/bash exec $1"},{"@type":"Answer","text":"<%@ exec request(\"cmd\") %>"}]},{"@type":"Question","position":6,"name":"What is the purpose of a Content Security Policy (CSP) header and how does it affect OSCP XSS exploitation?","acceptedAnswer":{"@type":"Answer","text":"It restricts which resources can be loaded and can block or mitigate XSS attacks"},"suggestedAnswer":[{"@type":"Answer","text":"It encrypts all web content between client and server"},{"@type":"Answer","text":"It prevents SQL injection by filtering database queries"},{"@type":"Answer","text":"It enforces HTTPS by redirecting all HTTP requests"}]}]}
OSCP Web Application Attacks 3 — Questions and Answers
Question 1: What does SSRF (Server-Side Request Forgery) allow an attacker to do?
- Forge HTTP responses from the server to the client
- Make the server send requests to internal or external resources on the attacker's behalf (Correct answer)
- Steal session cookies through cross-site scripting
- Forge SSL certificates to intercept traffic
Correct answer: Make the server send requests to internal or external resources on the attacker's behalf
SSRF tricks the server into making HTTP requests to internal or external resources, potentially exposing internal services not accessible from the internet.
Question 2: Which header injection vulnerability in HTTP responses can allow an attacker to inject additional HTTP headers or split responses?
- SQL header injection
- HTTP response splitting (Correct answer)
- Cookie path injection
- Content-type override
Correct answer: HTTP response splitting
HTTP response splitting injects CRLF (\r\n) characters into user-controlled input that is placed into HTTP headers, allowing attackers to inject additional headers or craft fake responses.
Question 3: When testing for SQL injection, which character is most commonly the first test to determine if input is vulnerable?
- Double quote (")
- Semicolon (;)
- Single quote (') (Correct answer)
- Percent sign (%)
Correct answer: Single quote (')
A single quote is the most basic SQL injection test because it breaks the SQL string context and causes a syntax error or behavioral change if the input is unsanitized.
Question 4: What is the purpose of the 'robots.txt' file and why is it relevant during OSCP web enumeration?
- It lists all administrative user accounts on the web server
- It tells search engine crawlers which pages to avoid, often revealing hidden directories (Correct answer)
- It stores the web server's SSL certificate information
- It configures firewall rules for the web application
Correct answer: It tells search engine crawlers which pages to avoid, often revealing hidden directories
The robots.txt file instructs web crawlers to skip certain paths, but these disallowed paths often contain sensitive directories that attackers can directly browse.
Question 5: During OSCP, you identify a PHP application. What common web shell one-liner could you attempt to upload?
- <script>exec($_GET['cmd'])</script>
- <?php system($_GET['cmd']); ?> (Correct answer)
- #!/bin/bash exec $1
- <%@ exec request("cmd") %>
Correct answer: <?php system($_GET['cmd']); ?>
The PHP one-liner '<?php system($_GET['cmd']); ?>' executes OS commands passed via the 'cmd' GET parameter, providing remote command execution on PHP servers.
Question 6: What is the purpose of a Content Security Policy (CSP) header and how does it affect OSCP XSS exploitation?
- It encrypts all web content between client and server
- It restricts which resources can be loaded and can block or mitigate XSS attacks (Correct answer)
- It prevents SQL injection by filtering database queries
- It enforces HTTPS by redirecting all HTTP requests
Correct answer: It restricts which resources can be loaded and can block or mitigate XSS attacks
CSP is a browser security mechanism that specifies trusted content sources; a strict CSP can prevent XSS payloads from loading external scripts or executing inline JavaScript.
