Command Injection WAHS Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the purpose of using output redirection in blind command injection?

   • ATo write the output of a command to a file that the attacker can later retrieve.
   • BTo make the command run faster.
   • CTo bypass input validation filters.
   • DTo prevent the command from being logged by the server.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which secure coding practice is most effective in preventing command injection when user input must be used in a system command?

   • AAllowlisting permitted values and rejecting anything else.
   • BUsing client-side validation to restrict input.
   • CEncoding user input with URL encoding.
   • DBlacklisting dangerous characters like ; and |.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is migrating a legacy application to a modern platform. The application currently builds shell commands from user input. The security team wants to eliminate command injection while minimizing code changes. Which strategy is most effective?

   • AUse a regular expression to strip all non-alphanumeric characters from user input.
   • BRun the application in a container with read-only filesystem.
   • CAdd a WAF rule to block requests containing common shell metacharacters.
   • DReplace shell commands with a safe API or library that provides the same functionality.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A development team is refactoring a legacy application that uses user input to construct shell commands. The application must maintain functionality for a wide range of inputs, including filenames with spaces and special characters. The team wants to eliminate command injection while minimizing code changes. Which approach best balances security and functionality?

   • AEscape all shell metacharacters in the input
   • BUse a WAF to filter malicious payloads
   • CUse a parameterized API that does not invoke a shell
   • DUse a blocklist of dangerous characters
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A developer is writing a web application that allows users to check the status of a server by entering an IP address. The developer uses the following code: `System.Diagnostics.Process.Start("ping " + ipAddress)`. A security review identifies a command injection vulnerability. What is the most secure way to fix this code?

   • AEscape all shell metacharacters in the IP address before concatenation.
   • BValidate the IP address using a regular expression before passing it to the command.
   • CRun the command with a low-privileged user account.
   • DUse a .NET library like `System.Net.NetworkInformation.Ping` to send ICMP packets.
   Reveal Solution Discussion Select an answer first