Objective 1.4 Exploit Web-Application Vulnerabilities. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A web application uses only cookies to maintain session state and does not include anti-CSRF tokens. Which condition makes it vulnerable to CSRF?

   • AThe application accepts requests with any HTTP method
   • BThe application uses HTTPS
   • CThe application relies on the browser to send cookies with requests
   • DThe application validates the Referer header
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   After compromising a web server, an attacker uploads a PHP script that accepts commands via a URL parameter. What is this script called?

   • AWeb Shell
   • BCross-Site Scripting payload
   • CReverse proxy
   • DSQL Injection payload
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which attack involves inserting malicious SQL code into a query to manipulate the database, such as bypassing authentication or extracting data?

   • ACross-Site Scripting (XSS)
   • BPath Traversal
   • CSQL Injection (SQLi)
   • DCommand Injection
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An attacker submits the following to a search parameter: %3Cscript%3Ealert(1)%3C%2Fscript%3E. What is the purpose of this encoding?

   • ATo prevent the server from logging the request
   • BTo make the request faster
   • CTo bypass input filters that block literal <script> tags
   • DTo encrypt the payload
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A web application has a form that takes a user's name and includes it in a system command: system('echo ' . $_POST['name']);. A tester submits ; cat /etc/passwd as the name. The response includes the contents of the password file. Which vulnerability is being exploited?

   • ASQL injection because the input is used in a database query
   • BCross-Site Scripting because the input is reflected in the response
   • CPath traversal because the input is used to access files
   • DCommand injection because the user input is concatenated into a system command without sanitization
   Reveal Solution Discussion Select an answer first