OSCP Web Application Attacks 3

Question 1

What does SSRF (Server-Side Request Forgery) allow an attacker to do?

Accepted Answer

Make the server send requests to internal or external resources on the attacker's behalf

Answer

SSRF tricks the server into making HTTP requests to internal or external resources, potentially exposing internal services not accessible from the internet.

Question 2

Which header injection vulnerability in HTTP responses can allow an attacker to inject additional HTTP headers or split responses?

Accepted Answer

HTTP response splitting

Answer

HTTP response splitting injects CRLF (
) characters into user-controlled input that is placed into HTTP headers, allowing attackers to inject additional headers or craft fake responses.

Question 3

When testing for SQL injection, which character is most commonly the first test to determine if input is vulnerable?

Accepted Answer

Single quote (')

Answer

A single quote is the most basic SQL injection test because it breaks the SQL string context and causes a syntax error or behavioral change if the input is unsanitized.

Question 4

What is the purpose of the 'robots.txt' file and why is it relevant during OSCP web enumeration?

Accepted Answer

It tells search engine crawlers which pages to avoid, often revealing hidden directories

Answer

The robots.txt file instructs web crawlers to skip certain paths, but these disallowed paths often contain sensitive directories that attackers can directly browse.

Question 5

During OSCP, you identify a PHP application. What common web shell one-liner could you attempt to upload?

Accepted Answer

<?php system($_GET['cmd']); ?>

Answer

The PHP one-liner '<?php system($_GET['cmd']); ?>' executes OS commands passed via the 'cmd' GET parameter, providing remote command execution on PHP servers.

OSCP Practice Test

OSCP Practice Test

OSCP Web Application Attacks 3