Web Application Injection Attacks GCIH Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A web application sets a session cookie and also reflects a user-controlled 'next' parameter in a redirect header. An attacker exploits this to perform session fixation by injecting a Set-Cookie header. The application is behind a reverse proxy that normalizes some headers but not all. Which remediation would be most effective to prevent session fixation via header injection?

   • ASet the Secure and HttpOnly flags on the session cookie
   • BRegenerate the session ID after login
   • CSanitize the 'next' parameter by removing CR and LF characters and validate it against a list of allowed redirect targets
   • DUse a relative redirect URL instead of an absolute URL
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A Java application parses XML documents from external partners. The security team must prevent XXE attacks, but some partners send XML documents that include internal DTDs for entity definitions. The application must continue to accept these documents. Which configuration would best balance security and functionality?

   • AAllow external entities but restrict them to a specific directory
   • BUse a SAX parser instead of a DOM parser
   • CDisable external entity resolution but allow internal DTDs
   • DDisable all DTD processing
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A web application accepts XML input and processes it with a parser that has external entities enabled. An attacker wants to perform a denial of service attack. Which payload would be most effective?

   • AA billion laughs attack using nested entity expansions
   • BAn external entity that references a remote URL
   • CA malformed XML document
   • DAn external entity that references a local file
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A Node.js application uses MongoDB and constructs a query like this: `db.users.find({ username: userInput })`. An attacker wants to extract the password of a specific user. Which payload would achieve this?

   • A`*`
   • B`{$ne: null}`
   • C`{"$regex": "^admin"}`
   • D`admin' OR '1'='1`
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A development team is fixing a SQL injection vulnerability in a legacy PHP application. The application uses string concatenation to build SQL queries. The team wants to implement a mitigation that is most effective against SQL injection while minimizing changes to the existing codebase. Which approach should they prioritize?

   • AEscape all user input with `addslashes()` before concatenation
   • BUse parameterized queries (prepared statements) for all database access
   • CValidate input with a regex that only allows alphanumeric characters
   • DAdd a web application firewall (WAF) rule to block suspicious SQL keywords
   Reveal Solution Discussion Select an answer first