Remote Code Execution (RCE) WAHS Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which of the following is a primary reason why using `eval()` on user-supplied input is dangerous?

   • AIt causes the server to crash if the input is not valid JSON.
   • BIt exposes the server's source code to the client.
   • CIt interprets the input as code, allowing an attacker to execute arbitrary commands on the server.
   • DIt slows down the application because `eval()` is inefficient.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A .NET application uses `BinaryFormatter` to deserialize a session token stored in a cookie. A security review flags this as a deserialization RCE risk. Which remediation is the most appropriate?

   • ASign the cookie with an HMAC to ensure it has not been tampered with.
   • BAdd a serialization binder that restricts allowed types to a known safe list.
   • CReplace `BinaryFormatter` with a secure serialization library such as JSON.NET and validate the token structure.
   • DEncrypt the cookie with a strong key so attackers cannot craft a malicious token.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A Java web application deserializes a base64-encoded cookie to restore user session state. The application uses a common library but does not restrict which classes can be deserialized. Which tool would you use to generate a malicious serialized object that executes a command when deserialized?

   • ABurp Intruder
   • Bysoserial
   • Csqlmap
   • DMetasploit's `java_deserialization` module
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A web application has a feature that converts user-supplied URLs into PDFs. The application passes the URL to a command-line tool using `system()` without sanitization. An attacker submits `http://example.com; cat /etc/passwd` and the PDF includes the file contents. Which remediation is the most effective?

   • AEscape all shell metacharacters in the URL before passing it to `system()`.
   • BUse a library that fetches the URL directly in the application code instead of invoking a shell command.
   • CValidate that the URL starts with `http://` or `https://` before passing it to the command.
   • DRun the command with a restricted shell that limits available commands.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is a common technique to identify a command injection vulnerability in a web application?

   • ASending a specially crafted HTTP header to trigger a buffer overflow.
   • BInserting a time-delay command such as `ping -c 10 127.0.0.1` and observing if the response is delayed.
   • CInserting a single quote into every input field and checking for a database error.
   • DUploading a web shell and then accessing it through the browser.
   Reveal Solution Discussion Select an answer first