Web Application Injection Attacks GCIH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Node.js application uses MongoDB and authenticates users with a query built as: db.users.findOne({ username: req.body.user, password: req.body.pass }). A tester sends a JSON body with "user" set to {"$ne": null} and "pass" set to {"$ne": null}, and successfully logs in as the first user. Which remediation would most directly prevent this NoSQL injection?

   • AUse a regular expression to block field names starting with '$'
   • BHash the password before including it in the query
   • CValidate that the username and password fields are strings before using them in the query
   • DUse the findOneAndUpdate method instead of findOne
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A development team is fixing an email header injection vulnerability in a PHP application that uses the `mail()` function. They want to prevent header injection while preserving the ability to set a custom 'From' address. Which mitigation is most effective?

   • AUse a WAF to block requests containing `\r\n`
   • BValidate and sanitize user input by removing CR and LF characters and using a secure email library
   • CUse the `mail()` function with additional parameters to set the 'From' address
   • DEncode user input with `htmlspecialchars()` before using it in the header
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team is tasked with identifying injection vulnerabilities in a newly developed web application before deployment. The application uses a mix of SQL, LDAP, and XML processing. Which testing approach would be most effective for discovering a wide range of injection flaws across these different technologies?

   • AConduct manual code review of only the SQL queries
   • BPerform only dynamic scanning with a generic web vulnerability scanner
   • CUse a web application firewall to block injection attempts during testing
   • DRun a combination of static analysis, dynamic scanning, and fuzzing with injection-specific payloads
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A web application allows users to specify a filename that is then passed to a shell command for processing: `system('cat ' . $_GET['file']);`. An attacker wants to read the `/etc/passwd` file. Which payload would achieve command injection?

   • A`/etc/passwd; cat /etc/shadow`
   • B`/etc/passwd && cat /etc/shadow`
   • C`; cat /etc/passwd`
   • D`/etc/passwd | cat`
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which XML parser configuration is secure against XXE?

   • AUsing a parser that automatically expands all entities.
   • BSetting the parser to not load external DTDs and not resolve external entities.
   • CDisabling entity expansion but allowing external DTDs.
   • DAllowing external entities but limiting them to local files.
   Reveal Solution Discussion Select an answer first