OSCP Web Application Attacks 2

Question 1

Which vulnerability occurs when user-supplied input is reflected in a web page without proper sanitization and executes in a victim's browser?

Accepted Answer

Cross-Site Scripting (XSS)

Answer

SQL Injection

Answer

Directory Traversal

Answer

CSRF

Question 2

When exploiting a Remote File Inclusion (RFI) vulnerability, what does the attacker typically host on their server?

Accepted Answer

A malicious PHP web shell

Answer

A SQL payload

Answer

A wordlist file

Answer

An SSL certificate

Question 3

What does the '--os-shell' flag in SQLmap attempt to do?

Accepted Answer

Obtain an interactive OS shell via SQL injection

Answer

Display the operating system version

Answer

Scan OS-level ports

Answer

Dump OS user hashes

Question 4

Which file extension is most commonly associated with a web shell uploaded during a PHP application attack?

Accepted Answer

.php

Answer

.sh

Answer

.exe

Answer

.asp

Question 5

What type of attack involves tricking a victim into sending authenticated requests to a vulnerable web application without their knowledge?

Accepted Answer

CSRF

Answer

XSS

Answer

SSRF

Answer

XXE

Question 6

During a web application assessment, you notice the URL contains 'page=about'. Which vulnerability should you immediately test for?

Accepted Answer

Local File Inclusion (LFI)

Answer

XSS

Answer

SQL Injection

Answer

CSRF

Question 7

Which Burp Suite tool is best suited for fuzzing parameters with multiple payloads to find injection points?

Accepted Answer

Intruder

Answer

Proxy

Answer

Repeater

Answer

Decoder