Reconnaissance and Mapping GWAPT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which activity is an example of active information gathering in web application penetration testing?

   • AReviewing the target's SSL certificate from a public log
   • BSearching for the target's name on a search engine
   • CQuerying WHOIS records for the target's domain
   • DSending HTTP requests to enumerate directories on the target
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester is mapping a web application's attack surface. The tester has identified several entry points: a login form, a search function, a file upload feature, and an API endpoint that accepts JSON. The tester needs to document the data flows and potential attack vectors for the final report. Which activity is most important to perform during the mapping phase?

   • ADocument only the technologies detected, such as web server and framework versions.
   • BCapture screenshots of each page and include them in the report without further analysis.
   • CRecord each entry point, the parameters it accepts, the HTTP methods used, and the backend functionality it triggers.
   • DRun a vulnerability scanner against each entry point to automatically identify all exploitable issues.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard · select all that apply

   A penetration tester is mapping the attack surface of a web application that includes a user profile page, a file upload feature, and an administrative panel. The tester has limited time and must decide which entry points to document in detail. The client has stated that the administrative panel is the highest-risk area. Which actions should the tester prioritize? Select all that apply.

   • ADocument the administrative panel's authentication mechanism, including any multi-factor authentication or IP restrictions.
   • BIdentify all functions and endpoints within the administrative panel, including any hidden or unlinked features.
   • CMap the data flow from the user profile page to the backend database, noting any potential injection points.
   • DEnumerate all parameters accepted by the file upload feature, including file type and size validation.
   • ERecord the technologies used by the entire application, including frameworks and server versions.
   Check answers Discussion Select an answer first
5. 29application · medium

   During an authorized penetration test, a tester visits the target login page and observes the HTTP response header 'Server: nginx/1.18.0' and a cookie named 'JSESSIONID'. The tester also notices that a 404 error page includes the text 'Apache Tomcat/9.0.50'. Which conclusion is most accurate?

   • AThe application is running on Microsoft IIS because JSESSIONID is a common IIS session identifier.
   • BThe application is likely Java-based and may be fronted by nginx, but further fingerprinting is needed to confirm the backend.
   • CThe application is definitely running on Apache Tomcat behind an nginx reverse proxy.
   • DThe web server is nginx, and the 404 page text is irrelevant because error pages are always generated by the front-end server.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   You need to automate the discovery of virtual hosts on a web server that hosts multiple applications. You have a list of potential subdomains. Which tool is most appropriate?

   • AWireshark to capture DNS queries
   • BBurp Suite's Repeater to manually test each subdomain
   • CNmap with the http-vhosts script
   • DWHOIS lookup for each subdomain
   Reveal Solution Discussion Select an answer first