Arbitrary File Upload and Download WAHS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A web application has a feature that downloads files based on a 'filename' parameter. An attacker changes the parameter to '../../etc/passwd'. What is the likely vulnerability?

   • AMIME type spoofing
   • BArbitrary file upload
   • CPath traversal in file download
   • DNull byte injection
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A developer is implementing file upload validation for a web application. The application should only accept PNG images. Which validation approach is the MOST reliable?

   • AUse a JavaScript client-side check to verify the file type before upload.
   • BCheck the MIME type from the client's request and the file extension.
   • CCheck only the file extension against a whitelist of .png.
   • DCheck the file's magic bytes (first few bytes) to verify it is a valid PNG, and also verify the file extension is .png.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A web application allows users to upload files, and the server-side validation checks the file extension and the MIME type from the file's magic bytes. However, the application also has a feature that allows users to preview uploaded images by including them in an HTML <img> tag. An attacker wants to achieve remote code execution. Which technique is most likely to succeed?

   • AUpload a file with a .php extension and rely on the server executing it.
   • BUpload a file with a double extension like 'shell.jpg.php' to bypass the extension check.
   • CUpload a polyglot file that is both a valid image and contains PHP code, then find a way to include it via a file inclusion vulnerability.
   • DUpload a file with a .jpg extension that contains PHP code and use the preview feature to include it.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is assessing the risk of an arbitrary file upload vulnerability in a legacy web application. The application allows authenticated users to upload profile pictures, and the upload directory is within the web root. The server is running Apache with PHP, and the application does not perform any file type validation. The team must decide the most critical impact to prioritize in their risk assessment. Which impact should be prioritized?

   • ARemote code execution via uploading a PHP web shell.
   • BPhishing attacks by uploading a fake login page.
   • CDenial of service by uploading a large number of files to exhaust disk space.
   • DCross-site scripting (XSS) by uploading an HTML file with malicious JavaScript.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An attacker successfully uploads a web shell to a vulnerable server. Which of the following is a direct consequence of this action?

   • AThe attacker can only deface the website but cannot access sensitive data.
   • BThe attacker can read, modify, or delete files on the server.
   • CThe attacker can only cause a denial of service by consuming resources.
   • DThe attacker can only upload more files but cannot execute them.
   Reveal Solution Discussion Select an answer first