PenTest+ Web Application Security Testing

Question 1

During a web application pentest, you discover that user input is reflected in an HTML page without sanitization. Which attack type should you attempt first?

Accepted Answer

Cross-Site Scripting (XSS)

Answer

When user input is reflected unsanitized in an HTML page, Cross-Site Scripting (XSS) is the most direct attack to attempt, as the browser will execute injected scripts.

Question 2

A tester submits the payload `' OR '1'='1` into a login form and gains unauthorized access. What vulnerability has been exploited?

Accepted Answer

SQL Injection

Answer

The payload manipulates the SQL query logic to always evaluate as true, which is a classic SQL Injection technique used to bypass authentication.

Question 3

Which OWASP Top 10 category describes a flaw where an application uses components with known security weaknesses such as outdated libraries?

Accepted Answer

Vulnerable and Outdated Components

Answer

OWASP A06:2021 - Vulnerable and Outdated Components specifically addresses the risk of using libraries, frameworks, or other software with known vulnerabilities.

Question 4

A web application accepts a URL parameter to redirect users after login. An attacker crafts a link that redirects victims to a malicious site. What vulnerability is this?

Accepted Answer

Open Redirect

Answer

An Open Redirect vulnerability occurs when an application accepts user-controlled input to redirect users, allowing attackers to redirect victims to malicious external sites.

Question 5

Which Burp Suite feature is most useful for intercepting and modifying HTTP requests between a browser and a web server during a pentest?

Accepted Answer

Proxy

Answer

Burp Suite's Proxy intercepts HTTP/HTTPS traffic between the browser and server, allowing a tester to view and modify requests and responses in real time.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ Web Application Security Testing