Command Injection WAHS Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A penetration tester has identified a blind command injection in a web application. The application runs on a Linux server, and the tester wants to exfiltrate the contents of `/etc/passwd`. The application does not return command output, but the web root is writable. Which method is most reliable?

   • AUse a reverse shell to get interactive access
   • BUse a DNS query to exfiltrate the file
   • CUse a time-based inference to read the file character by character
   • DRedirect the output to a file in the web root and then access it via HTTP
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security tester is evaluating a web application that passes a 'filename' parameter to a shell command. The application filters out `;`, `&`, and `|`. Which obfuscation technique is most likely to bypass the filter?

   • AUsing newline characters (`%0a`) to separate commands.
   • BUsing environment variable expansion like `$IFS` to replace spaces.
   • CUsing URL encoding for the semicolon (`%3b`).
   • DUsing backticks to execute a command substitution.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security architect is reviewing a legacy application that uses user input to construct shell commands. The team has a tight deadline and cannot refactor the code to use safe APIs. Which mitigation strategy provides the best balance of security and effort?

   • AAdd a WAF rule to block requests containing common shell metacharacters.
   • BRun the application in a container with a read-only filesystem and no network access.
   • CUse a denylist of known dangerous characters and replace them with safe alternatives.
   • DImplement a strict allowlist of allowed characters and reject any input that does not match.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of command injection using a command separator?

   • Ainput=1; cat /etc/passwd
   • Binput=../../etc/passwd
   • Cinput=1' OR '1'='1
   • Dinput=<script>alert(1)</script>
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the root cause of a command injection vulnerability?

   • AThe application uses an outdated version of the operating system.
   • BThe application stores user passwords in plaintext.
   • CThe application fails to validate user-supplied input before using it in a system command.
   • DThe application uses HTTPS instead of HTTP.
   Reveal Solution Discussion Select an answer first