Web and application pentesting: understanding vulnerabilities Final quiz

Final assessment: web pentesting and understanding vulnerabilities

Pass mark: 75%. You can retry as many times as you need.

1 A friend asks you to “quickly check” the security of a company website, saying nobody will mind. What do you need before doing anything? Single answer Nothing, as long as you only read and do not modify anything A signed contract, or a published programme, that gives written authorisation and a scope A professional version of Burp Suite Your friend’s verbal agreement

2 Which environments are legitimate places to practise the techniques of this course? (several answers) Multiple answers possible A deliberately vulnerable application running in your isolated virtual lab A small local shop’s website that seems outdated The PortSwigger Web Security Academy labs OWASP Juice Shop running on your own machine

3 During mapping you find a hidden form field holding a price and a robots.txt file listing an admin path. What is the right way to treat them? Single answer As protected: users cannot see hidden fields and robots.txt blocks access As irrelevant details to ignore As entry points and leads to record in the inventory and test later As proof that the site is already compromised

4 Your lab’s login form says “Unknown user” for non-existing accounts and “Wrong password” for existing ones, and accepts unlimited attempts. Which are valid recommendations? (several answers) Multiple answers possible Use one generic message for both cases Lock accounts permanently after a single failed attempt Add rate limiting or progressive delays Offer multifactor authentication

5 After logging in, the session identifier in your lab is identical to the one before login. Which fix is appropriate? Single answer Require longer passwords Regenerate the session identifier at login Move the cookie to a longer expiry Hide the cookie name in the page

6 A password reset returns the reset token directly in the HTTP response of the “forgot password” request. What is the consequence? Single answer Anyone who requests a reset for an account obtains the key without owning the mailbox Only the account owner can use it, so it is harmless It simply makes the page load more slowly It forces the user to enable multifactor authentication

7 Which design best prevents SQL injection in the code that looks up a customer by name? Single answer Remove a list of forbidden words from the input Escape quotes by hand and concatenate the value Limit the input length in the HTML form A parameterised query with a placeholder, plus a least-privilege database account

8 In a lab, a single apostrophe in a parameter causes a database error message. Which steps follow in a well-run test? (several answers) Multiple answers possible Confirm with a controlled true/false comparison Extract all customer records to measure the impact Record the evidence and write the finding Stop at the minimum proof needed for the report

9 An admin tool has a “check if a server is online” page that runs a system command with the typed host name. Which type of injection is the primary concern? Single answer Clickjacking Session fixation OS command injection Cross-site request forgery

10 A page repeats the search term in a heading without encoding it. Which defences address this reflected XSS? (several answers) Multiple answers possible Contextual output encoding when writing the value in the page A blacklist that removes a few HTML tags HttpOnly on the session cookie A restrictive Content Security Policy

11 A single-page application reads the URL fragment and inserts it using innerHTML. The server logs show nothing unusual. What kind of flaw is this? Single answer Stored XSS A DOM-based XSS SQL injection Server-side request forgery

12 Which combination best protects a “change email” action against CSRF? Single answer Use GET so that the request is simpler Hide the change-email button in the interface Validated anti-CSRF token, SameSite cookie and re-entry of the current password Add a Referrer-Policy header only

13 Which security response headers help against clickjacking and limit the effect of injected scripts? (several answers) Multiple answers possible Content-Security-Policy A Server header showing the exact software version X-Frame-Options X-Content-Type-Options set to nosniff

14 With your own accounts Alice and Bob, you replay Alice’s “view invoice” request with Bob’s session cookie and receive her invoice. What is the finding? Single answer CSRF Clickjacking Weak password policy IDOR (broken object-level access control)

15 Why is hiding the admin menu from ordinary users not a valid access control? (several answers) Multiple answers possible The underlying requests can still be sent directly to the server Browsers refuse to display hidden menus URLs can be discovered through scripts, logs or guessing Only a server-side check on each request enforces the role

16 A checkout confirmation page can be opened directly, skipping the payment step. Which description is the most accurate? Single answer A business logic flaw: the workflow state is not enforced on the server A TLS configuration problem A CSP misconfiguration A deserialization vulnerability

17 A feature fetches an image from a URL typed by the user. Which controls most reduce the SSRF risk? (several answers) Multiple answers possible An allowlist of permitted destinations over https A deny-list containing only the word localhost Validating the resolved IP address and not following redirects automatically Outbound network rules that block internal services

18 A scan reveals that your application uses a front-end library affected by a published CVE. Which is the best next step for the report? Single answer State the evidence, the CVE, the context and recommend updating Delete the library from the production server immediately without telling anyone Run public exploit code to prove the impact Ignore it, since the library was not written by the team

19 A photo upload feature must be made safe. Which measures are good practice? (several answers) Multiple answers possible Allowlist image types, verify and re-encode the real content Trust the content type sent by the browser Generate a random file name on the server Store files outside the web root and prevent execution there

20 Your report rates a finding using CVSS and obtains 7.5. What is its qualitative severity, and what should you also consider? Single answer Medium; nothing else matters once the score is known Critical; context is irrelevant High; also consider exposure, value at stake, active exploitation and chains Low; scores above 5 are always informational

21 You find a possible vulnerability in a public programme’s in-scope application and, while testing with your own two accounts, another customer’s name appears. What do you do? Single answer Browse more customers to measure how many are affected Stop, avoid copying the data, and report with evidence from your own accounts Publish the issue immediately so the organisation fixes it faster Ask the organisation for a reward before telling them what you saw