Web Application Attack Techniques and Exploitation EHE Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A security tester is evaluating a web service that parses XML requests. The tester suspects an XXE vulnerability. Which of the following is the most reliable way to confirm the vulnerability and read a local file?

   • ASubmit an XML payload that defines an external entity referencing 'file:///etc/passwd' and observe the response.
   • BUse a network scanner to check if the XML parser is outdated.
   • CSubmit a large XML payload to cause a denial of service and observe if the service becomes unresponsive.
   • DIntercept the XML request with Burp Suite and modify the Content-Type header to 'application/xml'.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A company's web application allows users to reset their password by answering a security question. The application stores the answer in plaintext and does not rate-limit attempts. An attacker has obtained a list of common answers from social media. Which combination of weaknesses is being exploited?

   • AWeak authentication mechanism and lack of brute-force protection.
   • BSession fixation and lack of HTTPS.
   • CCSRF on the password reset form and weak session management.
   • DSQL injection in the password reset form and weak password storage.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A security analyst notices that a web application sets a session cookie without the 'Secure' and 'HttpOnly' flags. The application also allows session IDs to be passed in the URL. Which attack is most directly facilitated by these weaknesses, and what is the best remediation?

   • ASQL injection; use parameterized queries.
   • BClickjacking; add X-Frame-Options header.
   • CCSRF; implement anti-CSRF tokens.
   • DSession hijacking via cookie theft; set the Secure and HttpOnly flags and disable URL-based session ID transmission.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   Which part of a web application's attack surface is most directly exposed to an attacker over the internet?

   • ADatabase internal network
   • BApplication server's internal API
   • CBackup storage system
   • DWeb server and client-side code
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A web application allows users to upload profile pictures. The developer only checks the file extension and MIME type. An attacker uploads a file named 'avatar.php' with a GIF header and PHP code. What is the most likely impact if the server executes the file?

   • ACSRF on the upload form.
   • BRemote code execution on the web server.
   • CXSS in the profile page.
   • DSQL injection in the database.
   Reveal Solution Discussion Select an answer first