GCIH Web App Injection Attacks Practice Test 2 — 15 Questions

Question 1

During a web application penetration test, an assessor discovers an endpoint vulnerable to OS Command Injection via an improperly sanitized ping utility parameter. Which TWO remediation strategies provide robust defense against command injection vulnerabilities?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Replace shell execution wrappers with native language libraries or built-in functions designed for the specific task.. Replacing insecure OS command execution functions with native language libraries or APIs completely avoids invoking the underlying operating system shell. When OS execution is strictly necessary, passing arguments as a fixed array rather than a concatenated string prevents shell metacharacter interpretation.

Answer

Apply strict input validation blacklists to filter out dangerous shell operators such as semicolons, pipes, and ampersands.

Answer

Configure the web server process to run with elevated root privileges to ensure access to system binaries.

Answer

Encode all user inputs using URL encoding standards before passing parameters into system shell execution functions.

Question 2

An incident responder analyzes a web application log and discovers that an attacker successfully extracted database schema names by manipulating a parameter where the application dynamically constructs SQL statements. The database error messages returned verbose structural details. Which remediation strategy provides the most robust defense against this injection vector while maintaining application functionality?

Accepted Answer

Refactor the data access layer to utilize parameterized queries and prepared statements exclusively.. Parameterized queries decouple user-supplied input from the SQL command structure, ensuring the database engine interprets data strictly as parameters rather than executable code. This eliminates SQL injection vulnerabilities at the architectural level, regardless of input complexity or encoding techniques, protecting the underlying database management system from unauthorized data access and structural enumeration.

Answer

Implement client-side JavaScript validation checks to strip dangerous SQL characters before submission.

Answer

Configure the web application firewall to block requests containing common SQL keywords like UNION and SELECT.

Answer

Disable verbose database error messages globally to prevent attackers from viewing schema details.

Question 3

An incident handler is reviewing WAF logs and notices repeated HTTP requests to a web application where the 'Host' header contains an attacker-controlled domain, while the request line targets the legitimate application server. The application uses the Host header to construct password-reset links emailed to users. Which web application injection attack class BEST describes this activity?

Accepted Answer

HTTP Host header injection leading to password reset poisoning. The attacker exploits the application's trust in the Host header to generate password-reset links. By setting the Host header to an attacker-controlled domain, the reset email contains a link pointing to that domain, allowing token theft. This is a classic Host header injection attack, distinct from CSRF, SSRF, and response splitting.

Answer

HTTP response splitting through CRLF injection in the Host header

Answer

Cross-Site Request Forgery (CSRF) against the password reset endpoint

Answer

Server-Side Request Forgery (SSRF) via the password reset functionality

Question 4

An incident handler is investigating a web application that uses a NoSQL database (MongoDB). The attacker sent a request with the parameter 'username[$ne]=admin&password[$ne]=wrong' and successfully authenticated as an administrator. Which of the following BEST describes the attack technique used?

Accepted Answer

NoSQL injection via operator injection in MongoDB query selectors. The attacker exploited the application's failure to sanitize user input before incorporating it into a MongoDB query. By injecting the $ne operator, the attacker changed the query to return a user record where the username and password are not equal to the supplied values, bypassing authentication. This is a classic NoSQL injection attack.

Answer

SQL injection using MongoDB's SQL compatibility layer

Answer

Cross-Site Scripting (XSS) through unsanitized input in the login form

Answer

LDAP injection exploiting the authentication backend

Question 5

A GCIH analyst is reviewing web server logs and sees repeated requests to /search?q=... where the q parameter contains strings like ../../../etc/passwd and ....//....//etc/shadow. The responses include root:x:0:0 entries. The application is a Java servlet that concatenates a user-supplied filename onto a base directory before calling new File(baseDir + userInput). Which vulnerability class best describes this incident?

Accepted Answer

Path Traversal. The attacker manipulates a filename parameter to escape the intended directory using ../ sequences and reads /etc/passwd, which is the defining behavior of Path Traversal. The vulnerable Java code concatenates user input onto a base path without canonicalization or validation, allowing the traversal. SSRF, LFI, and XXE each involve different mechanisms and would not produce this specific log pattern.

Answer

XML External Entity (XXE) injection

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 6

During incident response at a financial firm, an analyst discovers that a web application's login form is vulnerable to SQL injection. The backend is Microsoft SQL Server, and the application account has sysadmin rights. The attacker's payloads include ; EXEC xp_cmdshell 'whoami' -- and responses show the web server's service account name. Which immediate containment action best limits further damage while preserving evidence?

Accepted Answer

Disable the xp_cmdshell extended stored procedure and revoke sysadmin from the application's database login, after capturing relevant logs and database state.. The attacker leveraged sysadmin rights to run xp_cmdshell, achieving OS command execution through SQL injection. The most effective containment is to remove that capability by disabling xp_cmdshell and revoking sysadmin from the application login, while first preserving logs and database state. This stops the specific attack path without destroying evidence, unlike a full shutdown or restore.

Answer

Immediately shut down the database server and restore it from the most recent backup.

Answer

Enable full SQL query logging and wait for the next attack to gather more indicators before taking action.

Answer

Block the attacker's source IP address at the perimeter firewall and continue monitoring.

Question 7

During an incident response engagement, you discover that a web application constructs LDAP search filters by concatenating user input directly into the filter string. An attacker submits the username `*)(uid=*))(|(uid=*` into the login form and successfully authenticates as the first user in the directory. Which vulnerability class does this behavior represent?

Accepted Answer

LDAP injection. The attacker's payload uses LDAP filter metacharacters to change the logic of the directory search, resulting in authentication bypass. This is LDAP injection. Incident handlers must distinguish it from SQL injection and XSS by examining the payload syntax and the affected component. Recognizing the specific injection context guides containment and remediation, such as parameterizing LDAP queries and validating input.

Answer

Server-Side Request Forgery (SSRF)

Answer

XML External Entity (XXE) injection

Answer

Cross-Site Scripting (XSS)

Question 8

An incident handler is examining a web application that stores user profiles in a MySQL database. A recent breach exposed data through a query that the application builds as: SELECT * FROM profiles WHERE username = '" + userInput + "'. The handler wants to recommend a code-level fix that eliminates this class of vulnerability. Which approach should be recommended?

Accepted Answer

Use prepared statements with parameterized queries for all database interactions.. The application concatenates user input directly into SQL, creating an injection flaw. Prepared statements with parameterized queries ensure that input is treated strictly as data, never as SQL syntax, which eliminates the vulnerability class. WAF rules, quote escaping, and error suppression are compensating or hardening measures but do not remove the root cause.

Answer

Implement a web application firewall (WAF) rule that blocks common SQL injection patterns.

Answer

Limit database error messages returned to the user to prevent information leakage.

Answer

Escape single quotes and double quotes in user input before concatenation.

Question 9

An incident handler is investigating a web application that uses a templating engine. The application allows users to submit their name, which is later rendered in a greeting page. An attacker submits the payload `{{7*7}}` and the page displays `49`. The application also exposes an endpoint that accepts a template name as a parameter. Which vulnerability is most likely present?

Accepted Answer

Server-Side Template Injection (SSTI). The evaluation of `{{7*7}}` to `49` demonstrates that the application processes user input as a template expression. This is Server-Side Template Injection, which can lead to remote code execution depending on the engine. The secondary endpoint that accepts a template name further increases risk. Incident responders should isolate the application, review template engine logs, and check for any uploaded or modified templates.

Answer

Insecure deserialization

Answer

SQL injection

Answer

Reflected Cross-Site Scripting (XSS)

Question 10

A security analyst is reviewing an incident where an attacker submitted a specially crafted XML document to a SOAP API endpoint. The XML included a DOCTYPE declaration with an ENTITY that referenced file:///etc/passwd. The server's response contained the contents of that file. Which vulnerability was exploited?

Accepted Answer

XML External Entity (XXE) injection. The attacker exploited an XML parser that resolved external entities, using a file:// URI to read /etc/passwd. This is XML External Entity injection. The SOAP endpoint failed to disable DOCTYPE processing or external entity resolution, allowing the server to disclose local files. The other options describe different attack classes that do not match the XML entity mechanism.

Answer

Cross-Site Scripting (XSS)

Answer

Server-Side Request Forgery (SSRF)

Answer

SQL injection

Question 11

A security analyst notices that a web application reflects user-supplied input directly into an HTML attribute without encoding. An attacker crafts a URL that, when clicked by a victim, causes the victim's browser to execute a script that reads the victim's session cookie and sends it to an attacker-controlled server. Which type of attack is this?

Accepted Answer

Reflected Cross-Site Scripting (XSS). The attack reflects user input into an HTML attribute without encoding, causing script execution in the victim's browser when they click a crafted link. This is reflected XSS. The immediate execution and cookie theft are characteristic. Incident responders should validate input, apply context-aware output encoding, and consider Content Security Policy to mitigate such attacks.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Stored Cross-Site Scripting (XSS)

Answer

Clickjacking

Question 12

A GCIH analyst is investigating a web application that uses Java deserialization to process user-supplied session objects. The analyst suspects an attacker exploited an insecure deserialization vulnerability to achieve remote code execution. Which two indicators are most likely to confirm this type of attack? (Choose two.)

Accepted Answer

HTTP requests containing serialized Java objects with the magic bytes AC ED 00 05 in the body.. Insecure deserialization attacks require delivering a serialized payload, which for Java begins with the AC ED 00 05 magic bytes. Successful exploitation often results in remote code execution, frequently followed by outbound connections for command-and-control or exfiltration. These two indicators together confirm both the delivery and the impact, whereas the other options are either unrelated or nonspecific.

Answer

The presence of a new administrator account created in the application's user database.

Answer

Database error messages containing SQL syntax errors.

Answer

A sudden increase in the number of 404 errors for static image files.

Question 13

An incident handler is analyzing a web application that uses a NoSQL database. The application constructs queries by directly embedding user input into JSON objects. An attacker submits a payload that includes `$ne` and `$gt` operators to bypass authentication. Which TWO of the following statements accurately describe this attack or its mitigation? (Choose two.)

Accepted Answer

The attack is a NoSQL injection that exploits the lack of input sanitization in query operators.. NoSQL injection exploits unsanitized input that is interpreted as query operators, allowing authentication bypass or data manipulation. Effective mitigation includes using parameterized queries or ORMs, and sanitizing input to remove special operators. Incident handlers should review application code for direct concatenation of user input into NoSQL queries and check database logs for unusual operator usage.

Answer

The attack is only possible if the application uses MongoDB; other NoSQL databases are immune.

Answer

The attack can be mitigated by enabling strict mode in the NoSQL database, which blocks all operator usage.

Answer

The attack is a form of SQL injection because NoSQL databases use SQL-like syntax.

Question 14

An incident handler is investigating a web application that allows users to upload profile pictures. The application stores uploaded files in a directory accessible via the web and uses the original filename without sanitization. An attacker uploads a file named `shell.php.jpg` containing PHP code. The server executes the file when accessed via its URL. Which vulnerability has been exploited?

Accepted Answer

Unrestricted File Upload. The application allows an attacker to upload a file with a double extension and then executes it, resulting in remote code execution. This is an Unrestricted File Upload vulnerability. Mitigations include validating file types by content, not just extension, storing uploads outside the web root, and disabling script execution in upload directories. Incident responders should inspect upload logs and file system for malicious files.

Answer

Directory Traversal

Answer

Local File Inclusion (LFI)

Answer

Remote File Inclusion (RFI)

Question 15

During an incident response engagement at a healthcare portal, an analyst reviews an Apache access.log entry: GET /report.php?view=..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1 with a 200 response size of 1845 bytes. The application runs as www-data on Linux and the 'view' parameter is passed directly to readfile() without sanitization. Which web application injection attack class best describes what the attacker successfully executed?

Accepted Answer

Local File Inclusion via path traversal, allowing arbitrary file read within filesystem permissions. The URL-encoded traversal sequence in the 'view' parameter, combined with a 200 response and non-trivial body size, shows the application returned a file outside its intended directory. Since the parameter feeds PHP's readfile() rather than a shell or database call, the correct classification is Local File Inclusion via path traversal. The impact is limited to reading files accessible to the web server's user account, which still exposes credential material such as /etc/passwd.

Answer

SQL Injection, because the traversal sequence is being interpreted by the database engine

Answer

OS Command Injection, because readfile() ultimately invokes the operating system to open the file

Answer

Remote File Inclusion, because the attacker supplied a path referencing a remote resource