Web Application Forensics DFE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst reviews HTTP traffic and notices that a user's session cookie `sessionid=abc123` appears in a request to `https://example.com/profile`. Later, the same cookie value appears in a request from a different IP address and User-Agent. What should the analyst suspect?

   • AA normal user switching devices, because session cookies can be shared across devices.
   • BA cross-site request forgery (CSRF) attack, because the cookie is being sent cross-origin.
   • CSession fixation, because the server assigned the same session ID to both users.
   • DSession hijacking, because the same session token is being used from a different client.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A WAF log shows a request to `POST /transfer` with body `amount=1000&to_account=12345&_csrf=abc123`. The WAF did not block the request. The web server log shows the same request and a subsequent transfer of $1000 to account 12345. Later, the analyst discovers the `_csrf` token was not valid for the user's session. What attack likely occurred?

   • AA normal transaction, because the CSRF token is not required for transfers.
   • BA session hijacking attack, because the attacker used the user's session.
   • CA SQL injection attack, because the amount field was manipulated.
   • DA CSRF attack, because the request used an invalid CSRF token but the application did not validate it.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   An attacker exploits a vulnerability to upload a malicious script to a web server and then accesses it to execute code. Which attack vector best describes this scenario?

   • ADirectory traversal
   • BCross-site request forgery (CSRF)
   • CHTTP response splitting
   • DFile upload vulnerability
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An attacker submits a crafted URL that causes the web application to execute an operating system command. Which attack vector is being exploited?

   • ACommand injection
   • BSession fixation
   • CCross-site scripting (XSS)
   • DSQL injection
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which cookie attribute, when set, prevents client-side scripts from accessing the cookie, reducing the risk of session theft via XSS?

   • ADomain
   • BSameSite
   • CSecure
   • DHttpOnly
   Reveal Solution Discussion Select an answer first