File Upload, Response Readiness, Proactive Defense GWEB Practice Questions (Page 10)

Questions 46–47

1. 46application · medium

   A public-facing web application allows users to upload profile pictures. The current validation checks only the Content-Type header and the file extension. A penetration test demonstrated that an attacker can upload a file with a .jpg extension and image/jpeg Content-Type, but the file actually contains PHP code that executes when accessed. Which additional control would MOST effectively prevent this attack?

   • ARename the uploaded file to include a random string and store it in the web root.
   • BReject any file whose Content-Type is not exactly image/jpeg.
   • CStore uploaded files outside the web root and serve them through a download script that forces the correct Content-Disposition header.
   • DAdd a client-side JavaScript check that verifies the file signature before submission.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security team is configuring a WAF for a web application that allows file uploads. The WAF has a rule that blocks requests containing the string '<?php'. Legitimate users are reporting that their uploads are being blocked. What is the MOST likely cause?

   • AThe rule is generating false positives because legitimate files may contain the string '<?php' in non-executable contexts, such as text files or code snippets.
   • BThe WAF rule is case-sensitive and is matching '<?php' in the filename.
   • CThe WAF is not parsing multipart/form-data correctly, so it blocks all uploads.
   • DThe WAF is blocking all uploads because the rule is applied to the entire request body.
   Reveal Solution Discussion Select an answer first