Using AI for Web Exploitation GOAA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · medium

   What is the primary purpose of using AI to generate custom payloads for web exploitation?

   • ATo create payloads tailored to the specific vulnerabilities and context of the target application
   • BTo replace the need for understanding the underlying vulnerability
   • CTo automatically deploy payloads without any manual intervention
   • DTo ensure payloads are always undetectable by any security tool
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A developer is building an AI-powered tool that automatically generates XSS payloads for a web application that encodes angle brackets but does not filter event handlers. The tool must produce payloads that work in the application's context. What should the tool do to generate effective payloads?

   • AGenerate payloads that use only angle brackets and hope the application's encoding is inconsistent.
   • BGenerate a wide variety of standard XSS payloads and rely on the WAF to filter out ineffective ones.
   • CUse a pre-trained model that only outputs payloads from a fixed list of known XSS vectors.
   • DAnalyze the application's output encoding and generate payloads that use event handler attributes without angle brackets, then test them in a headless browser.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   After running an AI-driven exploitation tool against a web application, a tester receives a large JSON output containing status codes, response times, and extracted data. The tester needs to determine which findings are genuine vulnerabilities and which are false positives. What is the most effective way to analyze the output?

   • ACorrelate the AI-generated findings with manual verification of a sample of requests and responses, focusing on anomalies in status codes and data extraction.
   • BRe-run the tool with the same parameters and compare the outputs for consistency.
   • CTrust the AI tool's confidence scores and report only the highest-scoring findings without further review.
   • DUse a separate AI model to automatically classify findings as true or false positives without human review.
   Reveal Solution Discussion Select an answer first
5. 29foundation · medium

   How can the results of an AI-driven exploitation be used to refine attack strategies?

   • ABy identifying which payloads were blocked and adjusting them for future attempts
   • BBy showing the exact version of the web server software
   • CBy providing a list of all users on the system
   • DBy confirming that the target is invulnerable and stopping all further testing
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team is using an AI-assisted scanner to identify vulnerabilities in a web application that uses a content management system (CMS) with many third-party plugins. The scanner has a database of known vulnerabilities but is missing some custom application logic. Which approach would best improve the scanner's ability to discover vulnerabilities in the custom logic?

   • AUse the AI to generate custom fuzzing inputs based on the application's specific input parameters and business logic.
   • BRely solely on the scanner's built-in vulnerability database to identify known issues.
   • CDisable the scanner's fuzzing engine to avoid false positives and focus on known vulnerabilities.
   • DUse the scanner's default payloads without modification to ensure consistent results.
   Reveal Solution Discussion Select an answer first