PenTest+ Web Application Security Testing 1 — Questions and Answers
Question 1: During a web application pentest, you discover that user input is reflected in an HTML page without sanitization. Which attack type should you attempt first?
- SQL Injection
- Cross-Site Scripting (XSS) (Correct answer)
- Command Injection
- XML External Entity (XXE)
Correct answer: Cross-Site Scripting (XSS)
When user input is reflected unsanitized in an HTML page, Cross-Site Scripting (XSS) is the most direct attack to attempt, as the browser will execute injected scripts.
Question 2: A tester submits the payload `' OR '1'='1` into a login form and gains unauthorized access. What vulnerability has been exploited?
- Broken Authentication
- SQL Injection (Correct answer)
- LDAP Injection
- XPATH Injection
Correct answer: SQL Injection
The payload manipulates the SQL query logic to always evaluate as true, which is a classic SQL Injection technique used to bypass authentication.
Question 3: Which OWASP Top 10 category describes a flaw where an application uses components with known security weaknesses such as outdated libraries?
- Security Misconfiguration
- Vulnerable and Outdated Components (Correct answer)
- Injection
- Broken Access Control
Correct answer: Vulnerable and Outdated Components
OWASP A06:2021 - Vulnerable and Outdated Components specifically addresses the risk of using libraries, frameworks, or other software with known vulnerabilities.
Question 4: A web application accepts a URL parameter to redirect users after login. An attacker crafts a link that redirects victims to a malicious site. What vulnerability is this?
- Cross-Site Request Forgery (CSRF)
- Open Redirect (Correct answer)
- Clickjacking
- Server-Side Request Forgery (SSRF)
Correct answer: Open Redirect
An Open Redirect vulnerability occurs when an application accepts user-controlled input to redirect users, allowing attackers to redirect victims to malicious external sites.
Question 5: Which Burp Suite feature is most useful for intercepting and modifying HTTP requests between a browser and a web server during a pentest?
- Scanner
- Proxy (Correct answer)
- Repeater
- Intruder
Correct answer: Proxy
Burp Suite's Proxy intercepts HTTP/HTTPS traffic between the browser and server, allowing a tester to view and modify requests and responses in real time.
Question 6: During directory traversal testing, which payload would most likely help access /etc/passwd on a Linux web server?
- ../../../etc/passwd (Correct answer)
- %00../etc/passwd
- ..\..\windows\system32
- SELECT * FROM passwd
Correct answer: ../../../etc/passwd
The `../../../etc/passwd` payload uses dot-dot-slash sequences to traverse up the directory tree and access the sensitive /etc/passwd file on Linux systems.
Question 7: What is the primary purpose of testing for Cross-Site Request Forgery (CSRF) vulnerabilities in a web application?
- To inject malicious scripts into web pages viewed by other users
- To force authenticated users to unknowingly submit requests (Correct answer)
- To bypass server-side input validation
- To extract sensitive data from server databases
Correct answer: To force authenticated users to unknowingly submit requests
CSRF vulnerabilities trick authenticated users into submitting unintended requests (such as changing passwords or transferring funds) by exploiting the trust a site has in the user's browser.
PenTest+ Web Application Security Testing 1
During a web application pentest, you discover that user input is reflected in an HTML page without sanitization.
Which attack type should you attempt first?