Web Application Security Testing Flashcards

During a web application pentest, you discover that user input is reflected in an HTML page without sanitization. Which attack type should you attempt first?

Answer: Cross-Site Scripting (XSS)

When user input is reflected unsanitized in an HTML page, Cross-Site Scripting (XSS) is the most direct attack to attempt, as the browser will execute injected scripts.

A tester submits the payload `' OR '1'='1` into a login form and gains unauthorized access. What vulnerability has been exploited?

Answer: SQL Injection

The payload manipulates the SQL query logic to always evaluate as true, which is a classic SQL Injection technique used to bypass authentication.

Which OWASP Top 10 category describes a flaw where an application uses components with known security weaknesses such as outdated libraries?

Answer: Vulnerable and Outdated Components

OWASP A06:2021 - Vulnerable and Outdated Components specifically addresses the risk of using libraries, frameworks, or other software with known vulnerabilities.

A web application accepts a URL parameter to redirect users after login. An attacker crafts a link that redirects victims to a malicious site. What vulnerability is this?

Answer: Open Redirect

An Open Redirect vulnerability occurs when an application accepts user-controlled input to redirect users, allowing attackers to redirect victims to malicious external sites.

Which Burp Suite feature is most useful for intercepting and modifying HTTP requests between a browser and a web server during a pentest?

Answer: Proxy

Burp Suite's Proxy intercepts HTTP/HTTPS traffic between the browser and server, allowing a tester to view and modify requests and responses in real time.

During directory traversal testing, which payload would most likely help access /etc/passwd on a Linux web server?

Answer: ../../../etc/passwd

The `../../../etc/passwd` payload uses dot-dot-slash sequences to traverse up the directory tree and access the sensitive /etc/passwd file on Linux systems.

What is the primary purpose of testing for Cross-Site Request Forgery (CSRF) vulnerabilities in a web application?

Answer: To force authenticated users to unknowingly submit requests

CSRF vulnerabilities trick authenticated users into submitting unintended requests (such as changing passwords or transferring funds) by exploiting the trust a site has in the user's browser.