eJPT Web Application Penetration Testing 3 — Questions and Answers
Question 1: What is the key difference between Stored XSS and Reflected XSS?
- Stored XSS affects only the attacker; Reflected XSS affects all users
- Stored XSS persists in the database and executes for every visitor; Reflected XSS only executes for the victim who clicks a crafted link (Correct answer)
- Reflected XSS is more dangerous because it cannot be detected
- Stored XSS requires JavaScript to be disabled on the victim's browser
Correct answer: Stored XSS persists in the database and executes for every visitor; Reflected XSS only executes for the victim who clicks a crafted link
Stored XSS saves the malicious payload server-side (e.g., in a database) so it fires for every user who views the infected page, whereas Reflected XSS is delivered via a crafted URL.
Question 2: A web application uses MD5 to hash passwords without a salt. Why is this particularly dangerous?
- MD5 is not supported by modern browsers
- Unsalted MD5 hashes are vulnerable to rainbow table attacks (Correct answer)
- MD5 creates hashes that are too short to be secure
- MD5 hashes cannot be stored in databases
Correct answer: Unsalted MD5 hashes are vulnerable to rainbow table attacks
Without a salt, identical passwords produce identical MD5 hashes, making them trivially crackable using precomputed rainbow tables.
Question 3: Which tool is commonly used to perform automated SQL injection detection and exploitation during a penetration test?
- Nmap
- SQLMap (Correct answer)
- Nikto
- Gobuster
Correct answer: SQLMap
SQLMap is the industry-standard open-source tool for automated detection and exploitation of SQL injection vulnerabilities.
Question 4: What does CSRF (Cross-Site Request Forgery) primarily exploit?
- Weak session tokens that can be guessed
- The browser's trust in the authenticated user's session cookies (Correct answer)
- Unvalidated redirects in the target application
- JavaScript execution in the victim's browser
Correct answer: The browser's trust in the authenticated user's session cookies
CSRF exploits the fact that browsers automatically include session cookies with every request, tricking an authenticated user's browser into making unauthorized requests.
Question 5: When testing for Local File Inclusion (LFI), which file is a classic target on Linux systems to confirm successful exploitation?
- /var/log/syslog
- /etc/passwd (Correct answer)
- /root/.ssh/id_rsa
- /proc/version
Correct answer: /etc/passwd
/etc/passwd is the standard first test for LFI on Linux because it is readable by all users and its content is immediately recognizable.
Question 6: What is the purpose of using 'null byte injection' (%00) in older web application LFI attacks?
- To encode the payload to bypass WAFs
- To terminate a string early in PHP, bypassing file extension checks (Correct answer)
- To trigger a buffer overflow in the web server
- To inject SQL code alongside file paths
Correct answer: To terminate a string early in PHP, bypassing file extension checks
In older PHP versions, %00 (null byte) terminates the string, allowing attackers to bypass appended extension checks like .php by making /etc/passwd%00 ignore the forced extension.
Question 7: During a web app test, you observe a cookie set as: Set-Cookie: sessionid=abc123. What security attribute is critically missing?
- Domain attribute
- HttpOnly and Secure flags (Correct answer)
- SameSite=Strict setting
- Max-Age attribute
Correct answer: HttpOnly and Secure flags
Missing HttpOnly (prevents JS access) and Secure (ensures HTTPS-only transmission) flags expose the session cookie to XSS theft and network interception respectively.
eJPT Web Application Penetration Testing 3
What is the key difference between Stored XSS and Reflected XSS?