eJPT Web Application Penetration Testing 5 — Questions and Answers
Question 1: During a web application test, you find an input field that passes data to a system command. The input 'test; ls -la' returns a directory listing. What vulnerability is this?
- SQL Injection
- Remote Code Execution via Command Injection (Correct answer)
- Local File Inclusion
- XSS via DOM manipulation
Correct answer: Remote Code Execution via Command Injection
Command Injection occurs when user input is passed unsanitized to a system shell command, allowing attackers to execute arbitrary OS commands using separators like ; or &&.
Question 2: What is the OWASP Top 10 and why is it important for web penetration testers?
- A list of 10 tools every pentester must use
- A regularly updated list of the most critical web application security risks used as a benchmark for testing (Correct answer)
- A scoring system for rating vulnerability severity
- A certification framework for web security professionals
Correct answer: A regularly updated list of the most critical web application security risks used as a benchmark for testing
The OWASP Top 10 is a community-maintained document listing the most critical web application security risks, providing penetration testers with a prioritized framework for assessment.
Question 3: What does 'Content Security Policy' (CSP) primarily defend against?
- SQL Injection by restricting database queries
- XSS by controlling which sources can execute scripts on the page (Correct answer)
- CSRF by validating request tokens
- Brute force by limiting login attempts
Correct answer: XSS by controlling which sources can execute scripts on the page
CSP is an HTTP response header that tells browsers which content sources are trusted, mitigating XSS by blocking execution of scripts from unauthorized origins.
Question 4: When testing authentication, you notice the application uses Base64-encoded values in a cookie rather than a session ID. Why is this a security concern?
- Base64 increases cookie size beyond browser limits
- Base64 is encoding, not encryption — the data can be trivially decoded to reveal sensitive information (Correct answer)
- Base64-encoded cookies are incompatible with HTTPS
- Base64 cookies bypass HttpOnly restrictions automatically
Correct answer: Base64 is encoding, not encryption — the data can be trivially decoded to reveal sensitive information
Base64 is an encoding scheme, not encryption — anyone who intercepts the cookie can decode it instantly, potentially exposing usernames, roles, or other sensitive data.
Question 5: Which of the following best describes a 'time-based blind SQL injection' technique?
- Injecting UNION SELECT to retrieve data directly in the response
- Using conditional SQL statements that cause the database to pause (SLEEP/WAITFOR) to infer boolean responses (Correct answer)
- Exploiting verbose error messages to extract schema information
- Using a second HTTP request to confirm SQL injection success
Correct answer: Using conditional SQL statements that cause the database to pause (SLEEP/WAITFOR) to infer boolean responses
Time-based blind SQL injection uses functions like SLEEP() or WAITFOR DELAY to cause measurable delays, inferring true/false conditions when no data is returned in the response.
Question 6: What is the main purpose of the 'Secure' flag on an HTTP cookie?
- Prevents JavaScript from reading the cookie value
- Ensures the cookie is only transmitted over HTTPS connections (Correct answer)
- Restricts the cookie to same-site requests only
- Encrypts the cookie's value before storage
Correct answer: Ensures the cookie is only transmitted over HTTPS connections
The Secure flag instructs the browser to only send the cookie over encrypted HTTPS connections, preventing it from being intercepted over plain HTTP.
Question 7: During a web application test, you find a redirect URL in a parameter: http://example.com/redirect?url=http://evil.com. What vulnerability does this represent?
- Server-Side Request Forgery
- Open Redirect (Correct answer)
- Cross-Site Scripting
- HTTP Response Splitting
Correct answer: Open Redirect
An Open Redirect occurs when an application redirects users to attacker-controlled URLs without validation, commonly used in phishing attacks to exploit trust in the legitimate domain.
eJPT Web Application Penetration Testing 5
During a web application test, you find an input field that passes data to a system command.
The input 'test; ls -la' returns a directory listing.
What vulnerability is this?