Arbitrary File Upload and Download WAHS Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security engineer is reviewing a file download feature that uses a 'file' parameter to specify the file to download. The application runs on a Windows server and uses the following code: File.ReadAllText(basePath + "\\" + filename). The engineer discovers that an attacker can use the parameter to read files outside the intended directory. Which of the following is the MOST effective mitigation?

   • AReplace backslashes with forward slashes in the filename parameter.
   • BCheck that the file extension is in a list of allowed extensions.
   • CUse Path.GetFullPath to canonicalize the combined path and verify it starts with the base path before reading the file.
   • DUse a regular expression to block any filename containing '..'.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a common attack vector for arbitrary file uploads that targets other users rather than the server itself?

   • AUploading a malicious PDF that contains a phishing link
   • BUploading a file with a null byte to truncate the filename
   • CUploading a file with a double extension to bypass filters
   • DUploading a web shell to gain remote access
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a secure coding practice for file uploads?

   • AStore uploaded files in the web root with their original names.
   • BCheck only the client-provided MIME type.
   • CAllow any file type but rename it with a random name.
   • DUse a whitelist of allowed file extensions.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A web application allows users to upload files for sharing. The upload functionality does not restrict file types. An attacker wants to use this to distribute malware to other users. Which attack vector is most directly applicable?

   • AUploading a malicious executable disguised as a harmless document.
   • BUploading a file with a .php extension to achieve remote code execution.
   • CUploading a file with a null byte to truncate the filename.
   • DUploading a file with a double extension to bypass filters.
   Reveal Solution Discussion Select an answer first
6. 25application · medium · select all that apply

   A security analyst is reviewing the attack vectors for an arbitrary file upload vulnerability in a web application. The application allows users to upload files without any validation. Which of the following are common attack vectors that the analyst should be concerned about? (Select all that apply.)

   • AUploading a web shell to achieve remote code execution.
   • BUploading a file that exploits a client-side vulnerability in the browser.
   • CUploading a file with a double extension to bypass filters.
   • DUploading a malicious file that is distributed to other users as a phishing lure.
   Check answers Discussion Select an answer first