Web Application Attack Techniques and Exploitation EHE Practice Questions (Page 12)

Questions 56–57

1. 56foundation · easy

   An attacker sends a link to a victim that sets the victim's session ID to a known value before the victim logs in. After login, the attacker uses that same session ID to impersonate the victim. This is an example of:

   • ASession fixation
   • BCSRF
   • CSession hijacking
   • DCross-site scripting
   Reveal Solution Discussion Select an answer first
2. 57expert · hard

   A penetration tester is assessing a web application that uses a WAF. The WAF blocks common SQL injection patterns like 'OR 1=1' and 'UNION SELECT'. The tester wants to bypass the WAF and confirm SQL injection in the 'id' parameter. Which technique is most likely to succeed?

   • AUse a time-based payload like '; WAITFOR DELAY '0:0:5'--
   • BUse a simple payload like ' or 1=1--
   • CUse inline comments to break up the keyword, e.g., 'UN/**/ION SEL/**/ECT'.
   • DUse a boolean-based payload like ' AND 1=1--
   Reveal Solution Discussion Select an answer first