PenTest+ Web Application Security Testing 2

Question 1

A tester accesses `/api/users/1001` and then changes the ID to `/api/users/1002` to view another user's data without authorization. What vulnerability is this?

Accepted Answer

Insecure Direct Object Reference (IDOR)

Answer

Privilege Escalation

Answer

Mass Assignment

Answer

Broken Function Level Authorization

Question 2

Which vulnerability is exploited when an attacker injects an external entity into an XML document to read local files from the server?

Accepted Answer

XXE Injection

Answer

SSRF

Answer

XPath Injection

Answer

SSTI

Question 3

An attacker manipulates a URL parameter so the web server makes HTTP requests to internal network resources. What is this attack called?

Accepted Answer

Server-Side Request Forgery (SSRF)

Answer

Open Redirect

Answer

Command Injection

Answer

Remote File Inclusion (RFI)

Question 4

A web form accepts filenames and passes them directly to a shell command. Which attack allows an attacker to run arbitrary OS commands?

Accepted Answer

OS Command Injection

Answer

SQL Injection

Answer

Local File Inclusion

Answer

Server-Side Template Injection

Question 5

A PHP application includes files based on a `page` parameter: `include($_GET['page'] . '.php')`. How could a tester exploit Local File Inclusion (LFI)?

Accepted Answer

Using path traversal sequences like `../../../etc/passwd%00`

Answer

Passing a SQL query in the page parameter

Answer

Injecting JavaScript into the page parameter

Answer

Sending an oversized value to trigger a buffer overflow

Question 6

When testing REST APIs during a pentest, which technique helps identify endpoints that are not documented but may be accessible?

Accepted Answer

Fuzzing with wordlists of common API paths

Answer

Performing a SQL injection on each parameter

Answer

Capturing traffic with Wireshark

Answer

Running Nikto against the API server

Question 7

A session token always has the same value regardless of the user or login time. What session management weakness does this represent?

Accepted Answer

Predictable Session Token

Answer

Session Fixation

Answer

Missing Secure Flag

Answer

Session Hijacking