OSCP Web Application Attacks 1 — Questions and Answers
Question 1: What type of SQL injection allows an attacker to retrieve data by asking the database true/false questions?
- Union-based SQL injection
- Error-based SQL injection
- Boolean-based blind SQL injection (Correct answer)
- Out-of-band SQL injection
Correct answer: Boolean-based blind SQL injection
Boolean-based blind SQL injection infers data one bit at a time by submitting queries that return different responses based on whether the condition is true or false.
Question 2: Which SQLmap flag is used to attempt to read files from the target server's filesystem?
- --dump
- --file-read (Correct answer)
- --os-shell
- --sql-query
Correct answer: --file-read
The --file-read flag in SQLmap attempts to read a file from the database server's filesystem using database functions like LOAD_FILE() in MySQL.
Question 3: What is a Local File Inclusion (LFI) vulnerability in web applications?
- Including remote malicious scripts via JavaScript
- An application that allows reading local server files by manipulating file path parameters (Correct answer)
- A CSS injection via local style sheets
- SQL injection that reads local database files
Correct answer: An application that allows reading local server files by manipulating file path parameters
LFI occurs when an application includes files based on user-supplied input without proper validation, allowing an attacker to read sensitive server files using path traversal.
Question 4: What is the purpose of using Burp Suite's Intruder module during OSCP web application testing?
- Passive scanning of web traffic only
- Automated attacks like brute-forcing, fuzzing, and parameter manipulation (Correct answer)
- Decrypting SSL/TLS traffic
- Managing cookies across browser sessions
Correct answer: Automated attacks like brute-forcing, fuzzing, and parameter manipulation
Burp Suite Intruder automates customized attacks against web applications, including credential brute-forcing, parameter fuzzing, and injection payload delivery.
Question 5: Which HTTP method, if enabled on a web server, can allow an attacker to upload malicious files?
- GET
- OPTIONS
- PUT (Correct answer)
- TRACE
Correct answer: PUT
The HTTP PUT method is designed to upload files to a web server; if improperly enabled, it allows attackers to upload web shells or malicious scripts.
Question 6: What vulnerability exists when a web application passes user-supplied input directly to a system shell command?
- Cross-Site Scripting (XSS)
- Server-Side Request Forgery (SSRF)
- OS Command Injection (Correct answer)
- XML External Entity (XXE) Injection
Correct answer: OS Command Injection
OS Command Injection occurs when user input is concatenated into shell commands without sanitization, allowing attackers to execute arbitrary system commands.
OSCP Web Application Attacks 1
What type of SQL injection allows an attacker to retrieve data by asking the database true/false questions?