Arbitrary File Upload and Download WAHS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An attacker exploits a file download vulnerability to retrieve the application's 'config.php' file. What is the most direct impact?

   • AThe attacker can modify the configuration file.
   • BThe attacker gains access to database credentials and other sensitive configuration.
   • CThe attacker can cause a denial of service by downloading the file repeatedly.
   • DThe attacker can now execute arbitrary code on the server.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A web application allows users to upload files to a shared drive. The upload functionality does not restrict file types. An attacker wants to use this to launch a phishing campaign. Which attack vector is most directly applicable?

   • AUpload a file with a .php extension to achieve remote code execution.
   • BUpload a malicious HTML file that mimics a login page.
   • CUpload a file with a double extension to bypass filters.
   • DUpload a file with a null byte to truncate the filename.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A web application has a file download endpoint that accepts a 'file' parameter and serves files from a directory. A penetration test reveals that an attacker can retrieve the application's source code by requesting a file like 'config.php' using path traversal. What is the most likely impact of this vulnerability?

   • AThe attacker can modify the source code of the application.
   • BThe attacker can upload a web shell to the server.
   • CThe attacker can cause a denial of service by downloading large files.
   • DThe attacker can read sensitive configuration files, including database credentials and API keys.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is assessing a file upload feature that only validates the Content-Type header provided by the client. The tester wants to upload a PHP web shell. Which technique would MOST likely succeed?

   • AAppend a null byte to the filename, such as shell.php%00.png, to trick the server into saving it as shell.php.
   • BIntercept the upload request and change the Content-Type header to image/png while keeping the file content as PHP code.
   • CUpload a file with a .txt extension but include PHP code, then use a local file inclusion vulnerability to execute it.
   • DUse a double extension like shell.php.png and hope the server executes the first extension.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How does a path traversal attack in file downloads typically work?

   • ABy changing the HTTP method from GET to POST.
   • BBy injecting SQL commands into the download parameter.
   • CBy uploading a file with a malicious extension.
   • DBy using '../' sequences to navigate to directories outside the intended folder.
   Reveal Solution Discussion Select an answer first