Web Application Attacks and SQL Injection ECSS Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A penetration tester is testing a web application that uses a WAF. The tester suspects SQL injection but the WAF is blocking common payloads. The tester wants to bypass the WAF. Which of the following is the most effective technique?

   • AUse a more aggressive payload that the WAF might miss.
   • BUse case variations and inline comments to obfuscate the payload.
   • CUse a different injection point, such as a cookie or header.
   • DDisable the WAF by sending a specific HTTP header.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a manual method to detect SQL injection vulnerabilities?

   • ASubmitting a single quote (') in an input field and observing the response
   • BAnalyzing network traffic with Wireshark
   • CRunning a port scan with Nmap
   • DUsing a vulnerability scanner like Nessus
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A penetration tester is assessing a web application that is behind a WAF. The WAF blocks common SQL injection payloads such as UNION SELECT and OR 1=1. The tester suspects the application is still vulnerable. Which technique is most likely to bypass the WAF?

   • AUse encoding or obfuscation techniques, such as URL encoding or inline comments, to evade the WAF's signature rules.
   • BSend the payload in a different HTTP method, such as POST instead of GET.
   • CUse a time-based blind injection with a simple payload like ' AND SLEEP(5) -- .
   • DUse a more complex SQL injection payload that the WAF does not recognize.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which OWASP Top 10 risk involves attackers injecting malicious code into a web application that is then executed by other users?

   • ABroken Access Control
   • BInsecure Design
   • CSecurity Misconfiguration
   • DCross-Site Scripting (XSS)
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Why is the OWASP Top 10 relevant to penetration testing?

   • AIt is a mandatory compliance standard for all web applications.
   • BIt defines the exact tools required for every penetration test.
   • CIt provides a legal framework for conducting penetration tests.
   • DIt lists the most common web application security risks to prioritize testing.
   Reveal Solution Discussion Select an answer first