Directory Browsing and Bruteforcing WAHS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a brute force attack in the context of web application security?

   • AAn attack that attempts to guess valid credentials or other secrets by trying many possible combinations.
   • BAn attack that intercepts and modifies communication between a client and server.
   • CAn attack that exploits a vulnerability in the application's code to execute arbitrary commands.
   • DAn attack that overwhelms a server with traffic to cause a denial of service.
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   A penetration tester is examining a web application that has a directory listing enabled on the /files/ directory. The listing shows a file named 'document.pdf'. The tester wants to find other files that may not be listed. The tester suspects that the application uses a predictable naming convention. Which technique is most likely to reveal additional files?

   • AInspect the PDF metadata for the author's name.
   • BUse a search engine to find indexed files on the domain.
   • CCheck the web server's robots.txt for disallowed paths.
   • DUse a wordlist-based brute-force tool to guess filenames in the /files/ directory.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A penetration tester is assessing a legacy Apache web server. When the tester requests /images/ without a trailing filename, the server returns an HTML page listing all files in that directory, including backup configuration files. The organization wants to keep the files accessible but prevent the listing. Which server configuration change should the tester recommend?

   • AAdd a robots.txt entry to disallow crawlers from indexing the /images/ directory
   • BRename the backup files to have a .bak extension instead of .conf
   • CSet DirectoryIndex index.html in the directory configuration
   • DSet Options -Indexes in the directory's .htaccess or virtual host configuration
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of rate limiting in the context of brute force defense?

   • ATo block all traffic from a specific IP address permanently.
   • BTo limit the number of requests a client can make within a certain time period.
   • CTo increase the server's processing speed to handle more requests.
   • DTo encrypt all traffic between the client and server.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A penetration tester is performing a brute-force attack on a web application's login form. The application uses a CSRF token that is embedded in the form and must be submitted with each login request. The tester wants to automate the attack. Which technique is most appropriate?

   • AIgnore the CSRF token and send requests without it.
   • BDisable JavaScript in the browser and submit the form directly.
   • CUse a tool that can fetch the login page, extract the CSRF token, and include it in each subsequent request.
   • DUse a static CSRF token from the initial page for all requests.
   Reveal Solution Discussion Select an answer first