Reconnaissance and Mapping GWAPT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A web application returns a generic 404 error page for all invalid paths, but the response headers include 'X-Generator: Drupal 9'. You need to confirm the CMS version. Which action is most reliable?

   • AFetch the /CHANGELOG.txt file if it is accessible
   • BSearch the Drupal changelog for the version that introduced the X-Generator header
   • CSend a POST request to the user login form and observe the response
   • DUse Nmap's http-headers script to retrieve all headers
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   A penetration tester is planning the reconnaissance phase for a web application. The client has provided a list of allowed IP addresses for active scanning. Which statement correctly distinguishes passive from active reconnaissance?

   • APassive reconnaissance uses only public sources, while active reconnaissance involves direct interaction with the target
   • BPassive reconnaissance is faster than active reconnaissance
   • CPassive reconnaissance is always legal, while active reconnaissance requires a contract
   • DPassive reconnaissance is limited to DNS queries, while active includes HTTP requests
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A tester is using a custom script to perform content discovery on a web application. The script sends GET requests to a list of paths and records HTTP status codes. The tester notices that the application returns a 200 OK with a generic 'Page Not Found' body for non-existent paths, and a 404 status for some paths that actually exist. This behavior is confusing the script's logic. Which adjustment to the script is most appropriate?

   • AChange the script to use POST requests instead of GET to avoid the custom error handling.
   • BIncrease the number of requests per second to speed up the discovery process.
   • CModify the script to compare response bodies against a baseline 'not found' page instead of relying solely on status codes.
   • DIgnore the 200 responses and only trust 404 status codes as indicators of existing paths.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   During content discovery, you find that the application returns a 302 redirect to a login page for every unauthenticated request. You need to map the application's resources without authenticating. Which approach is most effective?

   • ASend POST requests to the login page to brute-force credentials
   • BIgnore all 302 responses and only record 200 responses
   • CUse a wordlist of common paths and follow redirects, recording the final URL and status code
   • DUse a spider that only crawls authenticated pages
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A senior tester is mapping a large web application that includes a public-facing site, a customer portal, and an internal API. The tester has limited time and must prioritize which areas to map in depth. The client has indicated that the customer portal handles sensitive financial data, while the public site is informational and the API is used by mobile clients. Which prioritization strategy is most effective?

   • AMap all areas equally to ensure complete coverage, since any missed vulnerability could be critical.
   • BPrioritize the customer portal and the API because they handle sensitive data and are likely to have more impactful vulnerabilities.
   • CFocus only on the public site because it is the most exposed to external attackers.
   • DMap the API first because it is the smallest and quickest to document, then move to the portal if time permits.
   Reveal Solution Discussion Select an answer first