OSCP Web Application Attacks 2 — Questions and Answers
Question 1: Which vulnerability occurs when user-supplied input is reflected in a web page without proper sanitization and executes in a victim's browser?
- SQL Injection
- Cross-Site Scripting (XSS) (Correct answer)
- Directory Traversal
- CSRF
Correct answer: Cross-Site Scripting (XSS)
XSS allows attackers to inject malicious scripts into web pages viewed by other users, potentially stealing cookies or performing actions on their behalf.
Question 2: When exploiting a Remote File Inclusion (RFI) vulnerability, what does the attacker typically host on their server?
- A SQL payload
- A malicious PHP web shell (Correct answer)
- A wordlist file
- An SSL certificate
Correct answer: A malicious PHP web shell
In RFI attacks, the attacker hosts a malicious script (commonly a PHP web shell) on their server, which the vulnerable application fetches and executes.
Question 3: What does the '--os-shell' flag in SQLmap attempt to do?
- Display the operating system version
- Obtain an interactive OS shell via SQL injection (Correct answer)
- Scan OS-level ports
- Dump OS user hashes
Correct answer: Obtain an interactive OS shell via SQL injection
SQLmap's --os-shell flag attempts to leverage SQL injection to achieve command execution and provide the attacker with an interactive operating system shell.
Question 4: Which file extension is most commonly associated with a web shell uploaded during a PHP application attack?
- .sh
- .exe
- .php (Correct answer)
- .asp
Correct answer: .php
PHP web shells use the .php extension so the web server interprets and executes the malicious code when the file is accessed via a browser or HTTP request.
Question 5: What type of attack involves tricking a victim into sending authenticated requests to a vulnerable web application without their knowledge?
- XSS
- SSRF
- CSRF (Correct answer)
- XXE
Correct answer: CSRF
Cross-Site Request Forgery (CSRF) forges authenticated requests from a victim's browser to perform unintended actions on a web application where they are logged in.
Question 6: During a web application assessment, you notice the URL contains 'page=about'. Which vulnerability should you immediately test for?
- XSS
- SQL Injection
- Local File Inclusion (LFI) (Correct answer)
- CSRF
Correct answer: Local File Inclusion (LFI)
A URL parameter that specifies a file or page name is a classic indicator of a potential LFI vulnerability, where user input directly controls file includes.
Question 7: Which Burp Suite tool is best suited for fuzzing parameters with multiple payloads to find injection points?
- Proxy
- Repeater
- Intruder (Correct answer)
- Decoder
Correct answer: Intruder
Burp Intruder automates customized attacks by fuzzing parameters with payload lists, making it ideal for finding injection vulnerabilities across multiple positions.
OSCP Web Application Attacks 2
Which vulnerability occurs when user-supplied input is reflected in a web page without proper sanitization and executes in a victim's browser?