eJPT Web Application Penetration Testing 4 — Questions and Answers
Question 1: What is the difference between a 'whitebox' and 'blackbox' web application penetration test?
- Whitebox tests use automated tools; blackbox tests are fully manual
- Whitebox provides the tester with source code and architecture details; blackbox gives no prior knowledge (Correct answer)
- Whitebox is performed externally; blackbox is performed from inside the network
- Whitebox targets APIs only; blackbox targets the UI only
Correct answer: Whitebox provides the tester with source code and architecture details; blackbox gives no prior knowledge
In a whitebox test the tester has full knowledge (source code, diagrams, credentials), while a blackbox test simulates an external attacker with zero prior information.
Question 2: Which Burp Suite feature allows you to send a request to multiple payloads automatically, cycling through a wordlist?
- Burp Repeater
- Burp Comparer
- Burp Intruder (Correct answer)
- Burp Proxy
Correct answer: Burp Intruder
Burp Intruder automates customized attacks by injecting payloads from a wordlist into marked positions within a request.
Question 3: What does the term 'parameter tampering' mean in web application security testing?
- Intercepting and modifying HTTP parameters to alter application logic or access unauthorized data (Correct answer)
- Injecting SQL code into URL parameters
- Changing HTTP headers to spoof the client's IP address
- Encrypting parameters to prevent server-side validation
Correct answer: Intercepting and modifying HTTP parameters to alter application logic or access unauthorized data
Parameter tampering involves modifying HTTP parameters (query strings, form fields, cookies) to manipulate application behavior in ways the developer did not intend.
Question 4: You discover a web application that makes server-side HTTP requests to URLs specified by user input. Which vulnerability is this?
- Open Redirect
- Server-Side Request Forgery (SSRF) (Correct answer)
- Remote File Inclusion (RFI)
- Command Injection
Correct answer: Server-Side Request Forgery (SSRF)
SSRF occurs when a server makes HTTP requests to attacker-controlled URLs, potentially allowing access to internal services or cloud metadata endpoints.
Question 5: Which HTTP status code typically indicates that a resource exists but the user is not authorized to view it, which can be useful during enumeration?
- 404 Not Found
- 403 Forbidden (Correct answer)
- 301 Moved Permanently
- 500 Internal Server Error
Correct answer: 403 Forbidden
A 403 Forbidden response confirms the resource exists but access is denied, whereas 404 would suggest the resource doesn't exist — making 403 useful for confirming valid paths.
Question 6: What is the primary risk of an 'Insecure Direct Object Reference' (IDOR) vulnerability?
- Executing arbitrary code on the server
- Accessing or modifying other users' data by manipulating object identifiers (Correct answer)
- Injecting malicious scripts into the DOM
- Bypassing authentication entirely
Correct answer: Accessing or modifying other users' data by manipulating object identifiers
IDOR allows attackers to access unauthorized resources (other users' files, records, accounts) simply by modifying an object reference like a user ID in a URL or request.
Question 7: Which tool is commonly used for directory and file enumeration against web servers during a penetration test?
- Wireshark
- Gobuster (Correct answer)
- Metasploit
- Hydra
Correct answer: Gobuster
Gobuster is a fast brute-force tool used to enumerate hidden directories, files, and DNS subdomains by sending HTTP requests using a wordlist.
eJPT Web Application Penetration Testing 4
What is the difference between a 'whitebox' and 'blackbox' web application penetration test?