Objective 1.4 Exploit Web-Application Vulnerabilities. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An attacker stores a malicious script in a blog comment field. When other users view the comment, the script executes in their browsers. Which XSS category does this describe?

   • AReflected XSS
   • BUniversal XSS
   • CStored XSS
   • DDOM-based XSS
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A login form is vulnerable to SQL injection. Which input could bypass authentication by making the query always return true?

   • AGET / HTTP/1.1
   • B' OR '1'='1
   • C<script>alert(1)</script>
   • D../../etc/passwd
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is investigating a web application that uses JavaScript to update the DOM based on the URL fragment. The application does not send the fragment to the server. A tester crafts a URL that, when clicked, executes a script in the victim's browser without any server-side reflection. Which type of XSS is being exploited?

   • AStored XSS because the script is stored on the server
   • BDOM-based XSS because the vulnerability is in the client-side JavaScript that processes the URL fragment
   • CCross-Site Request Forgery because the URL triggers a request
   • DReflected XSS because the URL is reflected in the response
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a web shell?

   • AA browser extension that automates web requests
   • BA tool for scanning web applications
   • CA script uploaded to a web server that allows remote command execution
   • DA type of firewall for web applications
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which vulnerability allows an attacker to include a file from a remote server, potentially leading to remote code execution?

   • ALocal File Inclusion (LFI)
   • BSQL Injection
   • CRemote File Inclusion (RFI)
   • DPath Traversal
   Reveal Solution Discussion Select an answer first