Web Application Attack Techniques and Exploitation EHE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A penetration tester is assessing a legacy web application that constructs SQL queries by concatenating user input directly into the WHERE clause. The tester wants to confirm the vulnerability and extract the contents of the 'users' table. Which tool and technique combination would be most appropriate?

   • ARun OWASP ZAP's active scanner with the 'SQL Injection' rule enabled and rely solely on the generated report.
   • BIntercept the request with Burp Suite and use the 'Intruder' tool with a wordlist of common SQL keywords to brute-force the database schema.
   • CUse Burp Suite's Repeater to manually craft a UNION-based injection payload and then use sqlmap to automate extraction.
   • DUse sqlmap with the --batch flag and default options to automatically detect and dump all databases.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A penetration tester is assessing a web application that stores user comments and displays them to other users without sanitization. The tester wants to demonstrate a stored XSS attack. Which of the following is the most appropriate way to confirm the vulnerability?

   • AUse OWASP ZAP's active scanner and check the report for XSS alerts.
   • BSubmit a comment containing a script that makes an alert, then view the comment as another user.
   • CSubmit a comment with a script and observe the response in Burp Suite's Repeater.
   • DUse sqlmap to inject a script into the database and then view the comment.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security tester is assessing a web service that parses XML. The service is behind a firewall that blocks outbound connections from the server. The tester suspects an XXE vulnerability but cannot use the classic external entity to read local files because the parser is configured to disable external entities. Which of the following is the most likely remaining attack vector?

   • AUse a command injection payload in the XML data.
   • BUse a file upload to read local files.
   • CUse an external entity to perform SSRF to internal services.
   • DUse an internal entity expansion (billion laughs) to cause a denial of service.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which countermeasure is most effective in preventing stored XSS attacks?

   • AImplementing rate limiting
   • BUsing a Web Application Firewall (WAF) only
   • COutput encoding of user-supplied data before rendering
   • DUsing HTTPS
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A developer reports that a comment section on a company's blog allows users to post HTML that is rendered verbatim. A tester wants to demonstrate the risk by making a victim's browser execute JavaScript when they view the page. Which attack best matches this scenario?

   • ACSRF by embedding a script in a comment that forces a user to change their password.
   • BStored XSS by submitting a comment containing <script>alert(document.cookie)</script>
   • CReflected XSS by crafting a URL with a script in the query string and tricking a user to click it.
   • DDOM-based XSS by modifying the page's DOM via the browser console.
   Reveal Solution Discussion Select an answer first