Reconnaissance and Mapping GWAPT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A web server returns a generic 500 error page with no version information. You suspect it is running nginx. Which passive method could confirm this?

   • ASearch for the server's IP address in public vulnerability databases
   • BSend a malformed request to trigger an nginx-specific error page
   • CUse Shodan to look up the server's banner and response headers
   • DCheck the DNS records for an 'nginx' subdomain
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A penetration tester is performing passive reconnaissance on a target web application. The tester has found a job posting on the company's website that mentions they are migrating from a legacy ASP.NET application to a new Node.js platform. The tester also finds a GitHub repository that appears to belong to the company and contains code snippets referencing 'Express' and 'MongoDB'. Which conclusion is most justified?

   • AThe application is still ASP.NET because the job posting says they are migrating, so the new stack is not yet in production.
   • BThe current application is definitely Node.js with Express and MongoDB, based on the GitHub repository.
   • CThe GitHub repository is irrelevant because code snippets do not indicate what is running in production.
   • DThe company is likely in the process of migrating to Node.js, and the GitHub repo may reflect the new stack, but the current production application may still be ASP.NET.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A penetration tester is using Burp Suite to map a web application. The tester has configured Burp as a proxy and is browsing the application manually. The tester wants to automatically discover hidden parameters by analyzing JavaScript files and forms. Which Burp Suite feature is most appropriate for this task?

   • ABurp Scanner's active scan, which will automatically test for hidden parameters.
   • BBurp's built-in content discovery tool, which can parse JavaScript and forms to find parameters and endpoints.
   • CBurp Repeater to manually send requests with guessed parameters.
   • DBurp Intruder with a parameter wordlist to brute-force parameter names on each endpoint.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A penetration tester is planning reconnaissance for a web application that is only accessible from a specific internal network. The tester has no access to the internal network yet. Which reconnaissance approach is feasible?

   • AUse Nmap to scan the internal network from outside
   • BSend phishing emails to employees to gain credentials
   • CWait until you have network access to start any reconnaissance
   • DPerform passive reconnaissance using public sources such as job postings and code repositories
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In the context of web application penetration testing, what is the primary difference between passive and active reconnaissance?

   • APassive reconnaissance is performed after active reconnaissance to confirm findings.
   • BPassive reconnaissance involves direct interaction with the target, while active reconnaissance relies on public information.
   • CPassive reconnaissance gathers information without directly interacting with the target, while active reconnaissance involves direct interaction.
   • DPassive reconnaissance is used only for network-level scanning, while active reconnaissance is used for web application testing.
   Reveal Solution Discussion Select an answer first