Web and application pentesting: understanding vulnerabilities Quiz

Quiz: configuration and component flaws

Pass mark: 70%. You can retry as many times as you need.

1 During an authorised lab review you find that the web server returns a detailed stack trace with file paths when you send an unexpected value. What is the best recommendation? Single answer Ask users not to send unexpected values Show a generic error page and log the details privately on the server Block the single value you used in the test Nothing: errors are useful for visitors

2 Which of these are typical misconfigurations a tester would report? (several answers) Multiple answers possible Default administrator credentials still active A generic error page with no technical detail Debug mode enabled in production Directory listing enabled on a folder that contains private files

3 You discover that an application uses a JavaScript library whose version is affected by a published CVE. What should your report say? Single answer That the site is definitely compromised Nothing: libraries are not the application’s responsibility The evidence for the version, the CVE, the relevance in context and the recommended update A working exploit demonstrating the impact on the live site

4 Which measures make a file upload feature safer? (several answers) Multiple answers possible Accept only an allowlist of needed file types and verify the real content Trust the content type declared by the browser Generate a random file name on the server Store files outside the web root and prevent execution there

5 A hidden form field contains a Base64 string that decodes to a natively serialized object with a role field, with no signature. What is the main concern? Single answer Base64 encoding makes the value encrypted and therefore safe The field might be rendered in italics by the browser The server may trust attacker-controlled serialized state, enabling tampering or worse The form will be slower to submit