Web Application Injection Attacks GCIH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A contact form on a website sends an email using a PHP mail() function. The 'subject' field is taken directly from user input and concatenated into the email header. An attacker submits a subject containing newline characters followed by Bcc: victim@example.com, causing the email to be sent to the victim. Which remediation would most directly prevent this email header injection?

   • AStrip CR and LF characters from the subject field before using it in the email header
   • BSet the From header to a fixed address
   • CLimit the subject field to 50 characters
   • DUse a secure email library that automatically encodes headers
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A developer is using an ORM (Object-Relational Mapping) library in a Python application. They write the following code to query a database: `session.query(User).filter("username = '{}'".format(user_input)).all()`. What is the primary vulnerability?

   • AThe code is vulnerable to command injection
   • BThe code is vulnerable to LDAP injection
   • CNo vulnerability because ORMs are inherently safe
   • DORM injection via raw SQL string in the filter method
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Java web service parses XML purchase orders submitted by external partners. During a security review, an analyst submits the following XML: <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><order><item>&xxe;</item></order>. The response includes the contents of /etc/passwd. Which configuration change would most directly prevent this attack?

   • AUse a SAX parser instead of a DOM parser
   • BEscape all ampersands and less-than signs in the XML input
   • CDisable DTD processing and external entity resolution in the XML parser
   • DValidate the XML against a strict XSD schema before parsing
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How can a format string vulnerability be exploited to read memory?

   • ABy using format specifiers like %x or %p to leak values from the stack.
   • BBy injecting SQL to read from the database.
   • CBy using XML external entities to read files.
   • DBy sending a large payload to cause a buffer overflow.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is email header injection?

   • AAn attack where an attacker injects newline characters into email headers to add malicious headers or content.
   • BAn attack that injects malicious commands into the OS.
   • CAn attack that injects malicious XML into a parser.
   • DAn attack that injects malicious SQL into a database.
   Reveal Solution Discussion Select an answer first