eJPT Web Application Penetration Testing 2 — Questions and Answers
Question 1: During a web application test, you discover a parameter that reflects user input directly in the HTML response without encoding. Which vulnerability is MOST likely present?
- SQL Injection
- Reflected XSS (Correct answer)
- CSRF
- Directory Traversal
Correct answer: Reflected XSS
When user input is reflected back in the HTML response without sanitization or encoding, it indicates a Reflected Cross-Site Scripting (XSS) vulnerability.
Question 2: What does the HTTP response header 'X-Frame-Options: DENY' protect against?
- SQL Injection attacks
- Clickjacking attacks (Correct answer)
- Cross-Site Request Forgery
- Directory traversal
Correct answer: Clickjacking attacks
X-Frame-Options: DENY prevents the page from being embedded in an iframe, protecting against clickjacking attacks.
Question 3: An attacker crafts a URL like: http://example.com/page?id=1 UNION SELECT username,password FROM users--. What attack is this?
- Blind SQL Injection
- Union-based SQL Injection (Correct answer)
- Time-based SQL Injection
- Error-based SQL Injection
Correct answer: Union-based SQL Injection
A UNION SELECT statement appended to a query is the hallmark of Union-based SQL Injection, used to retrieve data from other tables.
Question 4: Which Burp Suite tool is best for automatically testing all parameters in a web request for common vulnerabilities?
- Burp Repeater
- Burp Decoder
- Burp Scanner (Correct answer)
- Burp Sequencer
Correct answer: Burp Scanner
Burp Scanner automatically crawls and audits web applications for a wide range of vulnerabilities across all parameters.
Question 5: What is the primary purpose of the 'robots.txt' file in web application reconnaissance?
- It blocks all web crawlers from the site
- It can reveal hidden directories and sensitive paths that the admin wants to hide from search engines (Correct answer)
- It stores user credentials for bot accounts
- It defines the site's Content Security Policy
Correct answer: It can reveal hidden directories and sensitive paths that the admin wants to hide from search engines
robots.txt lists directories the site owner wants search engines to ignore, which often inadvertently reveals sensitive or hidden paths to attackers.
Question 6: During testing you find the URL: http://site.com/download?file=../../../etc/passwd. What vulnerability does this exploit?
- Remote File Inclusion
- Local File Inclusion / Directory Traversal (Correct answer)
- Server-Side Request Forgery
- Command Injection
Correct answer: Local File Inclusion / Directory Traversal
Using ../ sequences to navigate outside the intended directory to access system files is a Directory Traversal (Path Traversal) / Local File Inclusion attack.
Question 7: Which HTTP method should you test for on web forms to check if the server improperly handles data modification via GET requests?
- OPTIONS
- HEAD
- GET (Correct answer)
- TRACE
Correct answer: GET
Testing whether state-changing actions can be triggered via GET requests is important because it bypasses CSRF protections that rely on POST-only endpoints.
eJPT Web Application Penetration Testing 2
During a web application test, you discover a parameter that reflects user input directly in the HTML response without encoding.
Which vulnerability is MOST likely present?