OSCP Web Application Attacks 1 — Questions and Answers
Question 1: Which SQL injection technique retrieves data by asking the database true/false questions when no output is directly visible?
- Union-based injection
- Error-based injection
- Boolean-based blind injection (Correct answer)
- Time-based blind injection
Correct answer: Boolean-based blind injection
Boolean-based blind SQLi infers data by sending queries that return different responses based on true/false conditions, without requiring visible output.
Question 2: What does the SLEEP() function in a SQL injection payload help an attacker determine?
- The database version
- Whether the injection point exists via time delay (Correct answer)
- The table names in the database
- The number of columns in a query
Correct answer: Whether the injection point exists via time delay
SLEEP() is used in time-based blind SQLi to confirm a vulnerable injection point by causing a measurable delay in the server's response.
Question 3: Which tool is commonly used in OSCP labs to automate SQL injection discovery and exploitation?
- Nikto
- SQLmap (Correct answer)
- Hydra
- Gobuster
Correct answer: SQLmap
SQLmap is an open-source tool that automates detection and exploitation of SQL injection flaws, widely used during OSCP penetration tests.
Question 4: In a Local File Inclusion (LFI) vulnerability, which of the following payloads is used to traverse directories and read /etc/passwd?
- ../../../etc/passwd (Correct answer)
- SELECT /etc/passwd
- <?php include('/etc/passwd'); ?>
- ;cat /etc/passwd
Correct answer: ../../../etc/passwd
Path traversal sequences (../) are used in LFI to navigate up the directory tree and access files outside the web root such as /etc/passwd.
Question 5: Which HTTP method is most commonly exploited to upload a malicious web shell to a vulnerable web server?
- GET
- DELETE
- PUT (Correct answer)
- OPTIONS
Correct answer: PUT
The HTTP PUT method allows clients to upload files to a server; if misconfigured, attackers can upload a web shell granting remote code execution.
Question 6: What is the primary goal of directory brute-forcing with a tool like Gobuster during a web application assessment?
- Crack authentication passwords
- Discover hidden directories and files not linked on the site (Correct answer)
- Enumerate open ports on the target
- Perform SQL injection automatically
Correct answer: Discover hidden directories and files not linked on the site
Gobuster brute-forces URIs using wordlists to uncover hidden directories, files, and endpoints that may expose sensitive functionality or content.
Question 7: Which Burp Suite feature allows an attacker to intercept and modify HTTP requests between a browser and a web server?
- Scanner
- Repeater
- Proxy (Correct answer)
- Intruder
Correct answer: Proxy
Burp Suite's Proxy intercepts HTTP/HTTPS traffic between the browser and server, allowing the tester to view, modify, and replay requests in real time.
OSCP Web Application Attacks 1
Which SQL injection technique retrieves data by asking the database true/false questions when no output is directly visible?