File Upload, Response Readiness, Proactive Defense GWEB Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a web application with a critical remote code execution vulnerability in a third-party library. The vendor has released a patch, but the patch requires a restart of the application, which will cause downtime. The application is business-critical and cannot afford downtime during peak hours. Which approach BEST balances security and availability?

   • AApply the patch during the next scheduled maintenance window, but implement temporary mitigations such as a WAF rule to block exploit attempts.
   • BDo not apply the patch and rely on the application's existing security controls.
   • CApply the patch to a staging environment first, but do not deploy to production until the next major release.
   • DApply the patch immediately, accepting the downtime as necessary for security.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A web application development team is adopting a proactive defense strategy. They have limited budget and need to choose between implementing a WAF, conducting regular penetration tests, or establishing a threat modeling process. Which option provides the MOST comprehensive proactive benefit?

   • AConduct annual penetration tests to find vulnerabilities.
   • BPurchase a commercial vulnerability scanner and run it monthly.
   • CEstablish a threat modeling process that is integrated into the SDLC and informs security controls.
   • DDeploy a WAF to block known attack patterns in production.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A web application allows users to upload images. The server-side validation checks that the file extension is in a whitelist (.jpg, .png, .gif) and that the MIME type from the Content-Type header is an image type. An attacker successfully uploads a file named 'photo.jpg.php' and executes it. Which bypass technique did the attacker likely use, and what is the most effective defense?

   • AContent-type spoofing; the defense is to verify the file's magic bytes instead of trusting the header.
   • BNull byte injection; the defense is to strip null bytes from the filename before validation.
   • CDouble extension bypass; the defense is to reject any filename containing more than one extension and validate the final extension.
   • DMIME type mismatch; the defense is to compare the Content-Type header with the file extension.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A web application allows file uploads and uses a blacklist to block extensions like .php, .asp, and .exe. A penetration tester bypassed the filter by uploading a file named 'shell.phtml'. Why did the blacklist fail?

   • AThe file was a polyglot that bypassed the extension check.
   • BThe blacklist was case-sensitive and the file used uppercase letters.
   • CThe server did not check the file extension at all.
   • DThe blacklist was incomplete and did not include all executable extensions supported by the server.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary goal of content-type spoofing in a file upload attack?

   • ATo trick the server into accepting a malicious file by falsifying its MIME type
   • BTo make the server store the file with a different extension
   • CTo bypass file size limits
   • DTo hide the file from antivirus scanning
   Reveal Solution Discussion Select an answer first