Web Application Pentesting

Q1 Easy 10 pts

SQL injection primarily manipulates:

The web server CPU The database query the app builds The browser cache The TLS certificate

Q2 Medium 15 pts

Which XSS type is stored server-side and served to other users?

Reflected XSS Stored (persistent) XSS DOM-based XSS Blind SSRF

Q3 Medium 15 pts

Reflected XSS is delivered via:

A saved database record A crafted request/URL whose input is echoed back immediately A cron job The TLS handshake

Q4 Hard 20 pts

DOM-based XSS executes because:

The server stores it Client-side JavaScript writes untrusted data into the DOM unsafely The database is public The cert expired

Q5 Medium 20 pts

Best defense against SQL injection:

Hide error messages Parameterized queries / prepared statements Client-side validation only Longer passwords

Q6 Medium 20 pts

The vuln that tricks a server into requesting arbitrary URLs (often internal) is ____ (acronym).

Q7 Medium 20 pts

Accessing another user's record by changing an `id` parameter is:

Broken Access Control (IDOR) Misconfiguration Cryptographic Failure Vulnerable Component

Q8 Medium 15 pts

The header `X-Frame-____` (or CSP frame-ancestors) mitigates clickjacking.

Q9 Medium 15 pts

CSRF attacks abuse:

Server CPU A logged-in user's browser to send unwanted authenticated requests The TLS cipher The DNS resolver

Q10 Medium 15 pts

A primary CSRF defense is:

Base64 encoding Anti-CSRF tokens (and SameSite cookies) Higher temperature A longer URL

Q11 Medium 15 pts

The cookie flag that blocks JavaScript access is:

Secure HttpOnly SameSite Path

Q12 Easy 10 pts

The cookie flag that ensures cookies are sent only over HTTPS is:

HttpOnly Secure Domain Max-Age

Q13 Medium 15 pts

`SameSite=Strict/Lax` cookies primarily mitigate:

SQL injection CSRF XXE Path traversal

Q14 Medium 15 pts

Directory/path traversal uses sequences like `../` to:

Speed the site Access files outside the intended directory Encrypt data Set cookies

Q15 Hard 20 pts

XXE vulnerabilities arise from:

Unsafe XML parsing that processes external entities Too many cookies Weak TLS only Large images

Q16 Hard 20 pts

SSTI (Server-Side Template Injection) occurs when:

CSS is minified User input is embedded into a server-side template engine unsafely Cookies expire TLS renegotiates

Q17 Medium 15 pts

An 'open redirect' is dangerous because it:

Speeds navigation Lets attackers craft trusted-looking links that redirect to malicious sites Encrypts URLs Blocks phishing

Q18 Medium 15 pts

sqlmap is a tool that:

Draws network maps Automates detection and exploitation of SQL injection Cracks Wi-Fi Scans ports

Q19 Hard 20 pts

'Blind' SQL injection is inferred from:

Full error dumps Boolean/time-based responses rather than direct output The page title The favicon

Q20 Medium 15 pts

A WAF (Web Application Firewall) primarily:

Encrypts the database Filters/blocks malicious HTTP requests based on rules Manages DNS Stores sessions

Q21 Hard 20 pts

Insecure deserialization can lead to:

Faster load times Remote code execution or object injection Better SEO Smaller payloads

Q22 Medium 15 pts

The OWASP category covering outdated libraries with known CVEs is:

Vulnerable and Outdated Components Cryptographic Failures SSRF Logging Failures

Q23 Medium 15 pts

HSTS (HTTP Strict Transport Security) forces:

Plain HTTP Browsers to use HTTPS for the site Cookie deletion CSP rules

Q24 Medium 20 pts

Content Security Policy (CSP) helps mitigate:

SQL injection XSS by restricting allowed script sources XXE Path traversal

Q25 Hard 20 pts

A JWT 'alg: none' attack works when the server:

Uses HTTPS Accepts unsigned tokens by trusting the 'none' algorithm Rejects all tokens Uses SameSite

Q26 Hard 20 pts

'Mass assignment' vulnerabilities let attackers:

Send more email Set unintended object fields (e.g. isAdmin) via extra request params Crack hashes Scan ports

Q27 Hard 20 pts

CORS misconfiguration (e.g. reflecting Origin with credentials) can:

Speed the API Allow malicious sites to read authenticated responses Encrypt cookies Block XSS

Q28 Medium 20 pts

An unrestricted file upload is risky because an attacker may:

Improve the UI Upload a web shell to get code execution Compress images Add captions

Q29 Hard 20 pts

Session fixation is prevented by:

Reusing the same session ID Issuing a NEW session ID after authentication Longer cookies Base64 IDs

Q30 Medium 15 pts

A business-logic flaw example is:

A syntax error Applying a discount coupon unlimited times to pay near zero A 404 page A slow query

Q31 Hard 20 pts

Testing HTTP methods, an exposed `PUT` might allow:

Faster pages Uploading/overwriting files on the server Better caching TLS upgrade

Q32 Hard 20 pts

NoSQL injection (e.g. MongoDB) can bypass auth using:

A stronger password Operators like {'$ne': null} in a login query A new cookie A CSP header

Q33 Medium 15 pts

Rate limiting on login endpoints defends against:

XSS Brute-force/credential-stuffing XXE Clickjacking

Q34 Medium 15 pts

Verbose error messages are a risk because they:

Look professional Leak stack traces, queries and paths useful to attackers Speed the app Encrypt data

Q35 Medium 15 pts

The OWASP #1 (2021) category is:

Injection Broken Access Control SSRF Cryptographic Failures

Q36 Medium 15 pts

A03:2021 groups which flaw family?

Injection (SQLi, XSS, command) Logging failures SSRF Vulnerable components

Q37 Hard 20 pts

Second-order SQL injection triggers when:

Input executes on first entry Stored input is later used unsafely in another query TLS renegotiates A cookie is set

Q38 Hard 20 pts

GraphQL APIs can leak data via:

Small queries only Introspection and overly permissive queries returning excess fields TLS 1.3 SameSite cookies

Q39 Medium 20 pts

BOLA (Broken Object Level Authorization) in APIs is essentially:

A caching bug IDOR at the API layer — accessing objects you shouldn't A TLS flaw A DNS issue

Q40 Hard 20 pts

HTTP request smuggling exploits:

A single server Discrepancies in how front-end/back-end parse request boundaries A weak password A broken image

Q41 Hard 20 pts

Prototype pollution (JavaScript) can:

Improve performance Corrupt object prototypes leading to DoS or property injection/RCE Encrypt cookies Fix XSS

Q42 Hard 20 pts

Subresource Integrity (SRI) protects against:

Slow scripts Tampered third-party scripts/CDN content via hash verification XXE CSRF

Q43 Medium 20 pts

The best fix for XSS is:

Blocking the word 'script' Context-aware output encoding plus input validation and CSP Longer sessions Disabling cookies

Q44 Medium 15 pts

Insecure Direct Object References are best fixed by:

Obscuring IDs only Enforcing server-side authorization checks per object Using GET instead of POST Longer IDs alone

Q45 Medium 15 pts

Sensitive data in URLs is risky because URLs are:

Encrypted end to end Logged, cached, and stored in history/referrers Never stored Hidden by TLS entirely

Q46 Medium 15 pts

A 'parameter tampering' test involves:

Changing fonts Modifying hidden/price/role parameters to see if the server trusts them Resizing images Clearing cache

Q47 Medium 15 pts

Which finding is typically HIGHEST severity?

Missing security header Unauthenticated remote code execution Verbose 404 page Autocomplete on a form

Q48 Easy 10 pts

A good report for a web finding includes:

Only a screenshot Repro steps, impact, evidence and a remediation recommendation The exploit sold online Nothing

Q49 Easy 10 pts

Testing scope for web apps must be:

Assumed Explicitly authorized in writing before testing Ignored Decided mid-test

Q50 Medium 15 pts

Defense-in-depth for web apps means:

One perfect control Multiple layers (validation, authz, headers, WAF, monitoring) Only a WAF Only HTTPS