Command Injection WAHS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following best describes command injection?

   • AInjecting malicious HTML or JavaScript into a web page viewed by other users.
   • BOverloading a server with excessive requests to cause denial of service.
   • CInserting malicious SQL statements into a database query.
   • DExecuting arbitrary operating system commands on the server by manipulating input that is passed to a system call.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is migrating a legacy application to a modern framework. The application currently uses `system()` calls with user input. The migration must preserve the ability to run arbitrary system commands based on user-selected actions, but the selection must be restricted to a predefined set. Which approach is most secure?

   • AUse a blocklist of dangerous commands
   • BMap user selections to a server-side allowlist of commands and parameters
   • CUse a sandboxing tool to restrict command execution
   • DUse a WAF to filter malicious input
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of a parameter that could be vulnerable to command injection?

   • AA CSS class name in the HTML source
   • BThe browser's rendering engine version
   • CA URL query parameter like ?file=report.txt
   • DThe server's time zone setting
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team is hardening a web application that uses user input to construct a command. They want to implement a defense-in-depth approach. Which combination of controls is most effective?

   • AInput validation, parameterized APIs, and least-privilege execution
   • BOnly output encoding
   • COnly input validation
   • DOnly a web application firewall (WAF)
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A web application has a feature that allows users to specify a filename to be processed by a server-side script. The script uses the filename in a shell command. The development team wants to fix the vulnerability without breaking the feature. Which approach is most secure and functional?

   • AUse a WAF to filter malicious payloads
   • BValidate the filename against a strict pattern and use a safe API to handle the file
   • CUse a blocklist of dangerous characters
   • DEscape all shell metacharacters in the filename
   Reveal Solution Discussion Select an answer first