Reconnaissance and Mapping GWAPT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A tester is performing content discovery on a web application and has found a directory /admin/ that returns a 403 Forbidden status. The tester suspects there may be additional files or subdirectories under /admin/ that are not linked. The tester wants to continue discovery while minimizing the chance of being blocked. Which action is most appropriate?

   • AIgnore /admin/ because a 403 response indicates the directory is not accessible and not worth further effort.
   • BBrute-force /admin/ with a wordlist of common filenames and subdirectories, using a low request rate.
   • CUse a spider to crawl the /admin/ directory, assuming it will follow all links.
   • DRun a full recursive brute-force from the root with a large wordlist to cover all possibilities.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   You are tasked with automating the discovery of common backup files (e.g., .bak, .old, .zip) on a web server. You have a list of known filenames. Which tool is best suited for this task?

   • AMetasploit's auxiliary scanner for HTTP backup files
   • BWireshark to capture traffic and identify backup files
   • CBurp Suite's Intruder with a custom wordlist and response-code filter
   • DNmap with the http-backup-finder script
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A penetration tester is automating content discovery for a large web application. The tester wants to use a custom script to enumerate endpoints from a JavaScript file that contains API routes. The script should parse the JavaScript and extract URL paths, then test them with HTTP requests. Which tool or approach is best suited for this task?

   • AManually review the JavaScript file and note the endpoints in a spreadsheet for later testing.
   • BRun a standard directory brute-forcer with a generic wordlist against the root of the application.
   • CUse a regular expression in the script to match string literals that look like paths, then send requests to each unique path.
   • DUse a web crawler that follows links from the main page, assuming all endpoints are linked.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A penetration tester is actively enumerating a web application's parameters. The tester has identified an endpoint that accepts a 'debug' parameter. When the tester sends '?debug=1', the application returns a verbose error message that reveals the database query. The tester wants to continue exploring this behavior without causing a service disruption. Which action is most appropriate?

   • AStop testing the endpoint because verbose errors are a known vulnerability that should be reported immediately.
   • BImmediately attempt to exploit the database query with SQL injection to gain unauthorized access.
   • CSend a series of requests with different debug values to map the error-handling logic and potential injection points.
   • DUse a vulnerability scanner to automatically test the parameter for all known vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a primary source of passive information about a target's domain registration?

   • ABurp Suite proxy logs
   • BNmap scan results
   • CHTTP response headers from the target
   • DWHOIS database
   Reveal Solution Discussion Select an answer first