Remote Code Execution (RCE) WAHS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following tools is commonly used to automate the detection of command injection vulnerabilities?

   • ABurp Suite's Intruder or Repeater, along with manual payloads.
   • BNmap, a network scanner.
   • CWireshark, a packet analyzer.
   • DMetasploit, a penetration testing framework.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A penetration tester is assessing a web application that has a command injection vulnerability. The application does not reflect the output of the injected command. The tester wants to confirm the vulnerability and exfiltrate data. Which technique is the most appropriate?

   • AUse a payload that redirects the output to a netcat listener on the tester's machine.
   • BUse a time-based payload such as `; sleep 5` to confirm the vulnerability, then use an out-of-band channel like DNS to exfiltrate data.
   • CUse a payload that writes the output to a file in the web root and then retrieve it.
   • DUse a payload that causes an error message that includes the command output.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A web application allows users to upload images. The upload handler validates the file signature (magic bytes) and the MIME type, and stores files with a random name and a .jpg extension. However, the application also allows users to download files with a user-controlled filename. Which attack is most likely to succeed?

   • AUpload a file with a double extension like `shell.jpg.php`.
   • BUpload a polyglot file that is both a valid JPEG and a PHP script, then download it with a .php filename.
   • CUpload a file with a .htaccess content and then upload a .jpg file with PHP code.
   • DUpload a file with a null byte in the filename, e.g., `shell.php%00.jpg`.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the most accurate definition of remote code execution (RCE) in the context of web application security?

   • AAn attacker uses social engineering to trick an administrator into running a malicious script on the server.
   • BAn attacker redirects users to a malicious website that runs JavaScript in their browser.
   • CAn attacker gains access to the server's file system and reads sensitive files without executing any code.
   • DAn attacker causes the server to run arbitrary code of the attacker's choosing, often by exploiting an injection flaw.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A .NET application deserializes XML data from a request body to create objects. The application does not restrict the types that can be deserialized. Which tool or technique is most appropriate to test for deserialization RCE?

   • AUse a directory traversal payload to read the web.config file.
   • BUse ysoserial.net to generate a payload and send it in the XML body.
   • CUse sqlmap to inject SQL into the XML body.
   • DUse Burp Intruder to fuzz the XML with random strings.
   Reveal Solution Discussion Select an answer first