A Java application deserializes a base64-encoded cookie to restore user session state. A security review finds that the application uses `ObjectInputStream` directly on the cookie value. Which remediation is the most effective way to prevent deserialization-based RCE?

Replace Java serialization with a safe data format such as JSON and validate the session data structure.

Encrypt the cookie with AES so the attacker cannot read or modify the serialized payload.

Use a deny list of known dangerous classes in the deserialization filter.

Add a secret HMAC to the cookie so attackers cannot forge a malicious serialized object.

A web application allows users to upload images. The application validates the file's magic bytes and re-encodes the image to strip embedded scripts. However, the application stores the re-encoded image with the original filename and extension. Which additional control is necessary to prevent RCE?

Store the file with a random name and a whitelisted extension, and serve it from a directory with script execution disabled.

Set the file permissions to read-only after upload.

Use a WAF to block requests to the upload directory that contain PHP code.

Store the file in a database as a BLOB and serve it via a download script.

A web application allows users to upload documents. The upload handler checks the file extension against a blocklist (e.g., .php, .asp, .jsp) and stores files in a directory that is not directly web-accessible. Which additional weakness would still allow an attacker to achieve RCE?

The file is stored with a random name and a .txt extension.

The upload directory has execute permissions enabled.

The application includes the uploaded file via a server-side include using a user-controlled path.

The application validates the file content type using the `Content-Type` header.

During a penetration test, you are testing a web application that appears to pass user input to a system command. You want to confirm command injection without causing damage. Which payload is the most appropriate for a safe proof-of-concept?

`; ping -c 1 127.0.0.1` and check for a delay.

`; rm -rf /` to verify the command executes.

`; cat /etc/passwd` and check the response for the file contents.

`; sleep 5` and measure the response time difference.

EC-CouncilWeb Application Hacking and Security

Domain 2Objective 3

Remote Code Execution (RCE) WAHS Practice Questions (Page 5)

Part of the Injection Attacks domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~17–29 in this domain), expect 6–10 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 21–25

21application · medium
A Java application deserializes a base64-encoded cookie to restore user session state. A security review finds that the application uses `ObjectInputStream` directly on the cookie value. Which remediation is the most effective way to prevent deserialization-based RCE?
Select an answer first
22expert · hard
A web application allows users to upload images. The application validates the file's magic bytes and re-encodes the image to strip embedded scripts. However, the application stores the re-encoded image with the original filename and extension. Which additional control is necessary to prevent RCE?
Select an answer first
23application · medium
A web application allows users to upload documents. The upload handler checks the file extension against a blocklist (e.g., .php, .asp, .jsp) and stores files in a directory that is not directly web-accessible. Which additional weakness would still allow an attacker to achieve RCE?
Select an answer first
24application · medium
During a penetration test, you are testing a web application that appears to pass user input to a system command. You want to confirm command injection without causing damage. Which payload is the most appropriate for a safe proof-of-concept?
Select an answer first
25expert · hard
A web application has a command injection vulnerability in a file download feature. The application runs on a Windows server and uses `cmd.exe` to execute a command. The application filters out `&`, `|`, and `;`. Which payload is most likely to bypass the filter and execute a command?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.