Web and application pentesting: understanding vulnerabilities Quiz

Quiz: methodology and environment

Pass mark: 70%. You can retry as many times as you need.

1 Before testing a web application belonging to an organisation, what must you obtain first? Single answer A good set of tools and a Burp Suite licence Written authorisation and a defined scope Nothing, as long as you do not cause any damage The administrator’s oral agreement over the phone

2 Which statements about the OWASP Top 10 and the Web Security Testing Guide are correct? (several answers) Multiple answers possible The Top 10 lists categories of critical web application risks The WSTG explains how to test for those kinds of weaknesses Both are commercial software you must buy to run a test They are published by a community at owasp.org

3 Burp Suite’s proxy listens on 127.0.0.1:8080 and your browser is configured to use it. The browser seems frozen on a loading page. What is the most likely cause? Single answer The website has been permanently blocked by the proxy Burp has deleted your cookies The training application has been hacked Interception is on and the request is waiting to be forwarded

4 You set up a vulnerable training application on your computer. Which setup is the safest? Single answer Bound to 127.0.0.1 or on an isolated virtual network, with a snapshot to reset it On a public server so that friends can try it too Exposed on the home network so your phone can reach it On the same machine as your real data, with your usual passwords

5 During mapping you notice a hidden form field that contains a price. What is the right conclusion? (several answers) Multiple answers possible It is protected because users cannot see it It is an entry point that the client controls and can modify It should be added to the inventory for later testing The server should validate the price itself and not trust this value