OSCP Web Application Attacks 3

Question 1

In a UNION-based SQL injection attack, what must be true about the injected SELECT statement?

Accepted Answer

It must have the same number of columns as the original query

Answer

UNION-based SQLi requires the injected SELECT statement to return the same number of columns as the original query so the combined result set is valid.

Question 2

What is a common technique to bypass file upload filters that block PHP extensions?

Accepted Answer

Use double extensions like shell.php.jpg

Answer

Using double extensions such as shell.php.jpg can bypass naive file extension checks if the server processes the PHP extension before the final jpg extension.

Question 3

Which tool is commonly used during OSCP to enumerate web application directories using a wordlist?

Accepted Answer

Dirb

Answer

Dirb is a web content scanner that uses dictionary-based attacks to brute-force directories and files on web servers, commonly used for web enumeration during OSCP.

Question 4

What does an attacker gain when they successfully exploit an XML External Entity (XXE) vulnerability?

Accepted Answer

Ability to read arbitrary local files or perform SSRF

Answer

XXE vulnerabilities allow attackers to define external XML entities that reference local files or internal URLs, enabling file disclosure or Server-Side Request Forgery.

Question 5

When testing for reflected XSS, which of the following payloads is a basic proof-of-concept?

Accepted Answer

Answer

The classic XSS PoC payload tests whether user input is reflected unsanitized in the page and executes JavaScript in the browser.

OSCP - Offensive Security Certified Professional Practice Test

OSCP - Offensive Security Certified Professional Practice Test

OSCP Web Application Attacks 3