Web Application Attack Techniques and Exploitation EHE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A penetration tester is assessing a web application that uses URL-rewritten session IDs (e.g., http://example.com/page?sessionid=abc123). The tester notices that the session ID does not change after login. Which attack is most directly enabled by this behavior?

   • ACSRF, because the session ID is visible in the URL and can be used to forge requests.
   • BSQL injection, because the session ID parameter is not sanitized.
   • CXSS, because the session ID in the URL can be reflected in the page.
   • DSession fixation, because the attacker can provide a known session ID to the victim and then use the same ID after the victim authenticates.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which tool is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities?

   • Asqlmap
   • BNmap
   • CBurp Suite
   • DOWASP ZAP
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A security analyst is testing a web application's login form. The form takes a username and password, and the backend constructs a SQL query by concatenating the user input directly. The analyst wants to confirm the vulnerability without causing destructive changes. Which approach best validates the SQL injection while minimizing risk?

   • ASubmit a single quote (') in the username field and observe the application's error response.
   • BIntercept the login request in Burp Suite and replace the username with a time-based payload like '; WAITFOR DELAY '0:0:5'--
   • CRun sqlmap with the --batch flag against the login form to automate full exploitation.
   • DSubmit ' OR '1'='1 in the password field to attempt authentication bypass.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   An online banking application uses cookies for session management and does not validate the Origin or Referer header on state-changing requests. A user is logged in and visits a malicious forum. Which attack could the forum use to transfer money from the user's account without the user's knowledge?

   • AXSS in the forum that steals the bank's session cookie via a script.
   • BCSRF by embedding an image tag that triggers a GET request to the bank's transfer endpoint.
   • CSession fixation by setting a known session ID in the user's cookie before they log in.
   • DSQL injection in the forum's comment box to extract the bank's session data.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A developer is building a login form that accepts a username and password. The application uses a SQL database to store user credentials. Which of the following is the most secure approach to prevent SQL injection and protect passwords?

   • AStore passwords in plain text and rely on HTTPS to protect them in transit.
   • BEscape single quotes in the username and password before inserting them into the query.
   • CUse parameterized queries for authentication and store passwords as salted hashes.
   • DUse a stored procedure that concatenates the input into a dynamic SQL string.
   Reveal Solution Discussion Select an answer first