Most Common Application-Level Attacks CASENET Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A .NET application allows users to upload profile pictures. An attacker uploads a file named 'photo.aspx' containing server-side script. The application stores the file in a folder that is served by IIS. What is the most likely impact, and which control would prevent it?

   • ADirectory traversal; sanitize the file path.
   • BCross-site scripting; encode the file name when displaying it.
   • CRemote code execution; restrict uploads to allowed extensions and store files outside the web root.
   • DDenial of service; limit the file size and number of uploads.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A .NET application's authentication logs show a high number of failed login attempts for a single username from a single IP address, with each attempt using a different password. Which attack is indicated, and what is the most effective mitigation?

   • ABrute-force attack; implement account lockout and rate limiting.
   • BSession fixation; regenerate session IDs.
   • CCredential stuffing; require multi-factor authentication.
   • DSQL injection; use parameterized queries.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A .NET application's logs show a series of requests to /api/upload with a 'filename' parameter containing '..\..\web.config'. The application saves the file using the provided filename. Which attack is indicated, and what is the most effective mitigation?

   • APath traversal; use Path.GetFileName to strip directory components and store files in a random-named directory.
   • BSQL injection; use parameterized queries.
   • CCommand injection; use ProcessStartInfo with argument lists.
   • DXSS; encode the filename in the response.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security analyst is reviewing logs and sees a series of requests to /api/search with the parameter q=%3Cscript%3Ealert(1)%3C%2Fscript%3E. The response includes the same script tag in the HTML body. The analyst also notices that the application sets a cookie named sessionId without the HttpOnly flag. What is the most likely impact of this vulnerability?

   • AAn attacker can steal the session cookie and impersonate the user.
   • BAn attacker can modify the database by injecting SQL.
   • CAn attacker can cause a denial of service by overloading the server.
   • DAn attacker can perform a CSRF attack without user interaction.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which attack category is characterized by an attacker causing a victim's browser to send a request that the victim did not intend, leveraging the victim's authenticated session?

   • ACross-Site Request Forgery (CSRF)
   • BInsecure Deserialization
   • CSQL Injection
   • DCross-Site Scripting (XSS)
   Reveal Solution Discussion Select an answer first