PenTest+ Web Application Security Testing 2 — Questions and Answers
Question 1: A tester accesses `/api/users/1001` and then changes the ID to `/api/users/1002` to view another user's data without authorization. What vulnerability is this?
- Privilege Escalation
- Insecure Direct Object Reference (IDOR) (Correct answer)
- Mass Assignment
- Broken Function Level Authorization
Correct answer: Insecure Direct Object Reference (IDOR)
Insecure Direct Object Reference (IDOR) occurs when an application exposes internal implementation objects (like user IDs) without proper authorization checks, allowing access to other users' data.
Question 2: Which vulnerability is exploited when an attacker injects an external entity into an XML document to read local files from the server?
- SSRF
- XXE Injection (Correct answer)
- XPath Injection
- SSTI
Correct answer: XXE Injection
XML External Entity (XXE) Injection exploits weakly configured XML parsers to process external entity declarations, which can allow file disclosure, SSRF, or denial of service.
Question 3: An attacker manipulates a URL parameter so the web server makes HTTP requests to internal network resources. What is this attack called?
- Open Redirect
- Command Injection
- Server-Side Request Forgery (SSRF) (Correct answer)
- Remote File Inclusion (RFI)
Correct answer: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) forces the server to make requests to internal or external resources, potentially exposing internal services not directly accessible to the attacker.
Question 4: A web form accepts filenames and passes them directly to a shell command. Which attack allows an attacker to run arbitrary OS commands?
- SQL Injection
- Local File Inclusion
- OS Command Injection (Correct answer)
- Server-Side Template Injection
Correct answer: OS Command Injection
OS Command Injection occurs when user-supplied input is incorporated into shell commands without proper sanitization, allowing attackers to execute arbitrary operating system commands.
Question 5: A PHP application includes files based on a `page` parameter: `include($_GET['page'] . '.php')`. How could a tester exploit Local File Inclusion (LFI)?
- Passing a SQL query in the page parameter
- Using path traversal sequences like `../../../etc/passwd%00` (Correct answer)
- Injecting JavaScript into the page parameter
- Sending an oversized value to trigger a buffer overflow
Correct answer: Using path traversal sequences like `../../../etc/passwd%00`
By using path traversal sequences and a null byte to truncate the .php extension, a tester can include arbitrary files from the server's filesystem via the LFI vulnerability.
Question 6: When testing REST APIs during a pentest, which technique helps identify endpoints that are not documented but may be accessible?
- Fuzzing with wordlists of common API paths (Correct answer)
- Performing a SQL injection on each parameter
- Capturing traffic with Wireshark
- Running Nikto against the API server
Correct answer: Fuzzing with wordlists of common API paths
Fuzzing API endpoints with wordlists (using tools like ffuf or Gobuster) discovers undocumented or hidden endpoints that may lack proper access controls.
Question 7: A session token always has the same value regardless of the user or login time. What session management weakness does this represent?
- Session Fixation
- Predictable Session Token (Correct answer)
- Missing Secure Flag
- Session Hijacking
Correct answer: Predictable Session Token
A static, unchanging session token is a Predictable Session Token weakness; tokens must be sufficiently random and unique per session to prevent unauthorized reuse or guessing.
PenTest+ Web Application Security Testing 2
A tester accesses `/api/users/1001` and then changes the ID to `/api/users/1002` to view another user's data without authorization.
What vulnerability is this?