GCIH Web App Injection Attacks — Timed 20 Questions

Question 1

An application uses a parameterized query: SELECT * FROM users WHERE username = ?. If an attacker inputs 'OR 1=1' into the username field, what is the most likely outcome?

Accepted Answer

The database returns no results.. Parameterized queries treat user input strictly as data, not as executable code. Because the entire input string is interpreted as a literal username value rather than a command, the database will attempt to find a user literally named 'OR 1=1'. This effectively neutralizes the injection attempt, preventing the bypass of authentication logic that would otherwise occur in raw string concatenation scenarios common in legacy applications.

Answer

The query returns all rows from the users table.

Answer

The database engine throws a syntax error.

Answer

The application crashes due to an unhandled exception.

Question 2

Which THREE of the following are recommended practices for mitigating Command Injection vulnerabilities?

Accepted Answer

Avoid calling system commands directly.. Command injection occurs when untrusted input is passed to a system shell. Mitigation requires preventing this interaction entirely. Using built-in language APIs rather than shell commands is the safest approach. If system calls are unavoidable, strict allow-listing and input validation ensure only expected characters are passed to the OS, preventing the execution of unintended commands. These layered defenses are critical for protecting the underlying server infrastructure from total compromise.

Answer

Escape input using a generic blacklist.

Answer

Run the application with root privileges.

Question 3

An incident responder investigates a web application running a legacy PHP backend. Users report that searching for specific product SKUs causes the application to dump database table structures directly onto the results page. Which underlying vulnerability class is most likely responsible for this behavior?

Accepted Answer

Error-based SQL injection via unescaped search input processed directly by the database engine. Error-based SQL injection occurs when database error messages are displayed directly to the end user through the web interface. Attackers leverage these verbose debugging messages to extract database schemas, table names, and sensitive column contents piece by piece. Remediating this requires implementing custom error handling and parameterized queries globally.

Answer

Cross-Site Scripting via injected JavaScript payloads in the SKU search field

Answer

Remote Code Execution via insecure deserialization of serialized PHP objects

Answer

XML External Entity injection via malformed search queries processed by an XML parser

Question 4

An incident handler is analyzing an incident where a web application was compromised via SQL injection. The backend database uses a modern relational database management system. Which TWO of the following remediation strategies are considered primary defenses against SQL injection attacks? (Choose TWO)

Accepted Answer

Implementing parameterized queries or prepared statements for all database interactions. Effective mitigation of SQL injection requires separating user-supplied data from executable query statements. Parameterized queries enforce strict data typing and prevent interpreters from executing user input as code, while robust input validation adds a crucial defense-in-depth layer by rejecting malformed payloads before database interaction.

Answer

Enabling client-side JavaScript validation to strip out single quotes and semicolons

Answer

Relying exclusively on Web Application Firewall signature blocking rules

Answer

Encoding all database query outputs using HTML entity encoding before rendering

Question 5

An organization discovers that an attacker executed operating system commands via a vulnerable web application endpoint. The application takes user input, constructs an XML payload, and passes it to an underlying XML parser without disabling external entity resolution. Which type of vulnerability enabled this command execution?

Accepted Answer

XML External Entity injection exploiting insecure XML parser configurations. XML External Entity (XXE) injection arises when applications parse untrusted XML input with external entity processing enabled. Attackers can define malicious entities referencing local system files, internal network resources, or command execution wrappers, leading to severe data compromise or remote code execution scenarios.

Answer

Server-Side Template Injection via malicious expressions evaluated by template engines

Answer

Cross-Site Scripting via injected script tags within CDATA sections

Answer

LDAP injection through improper attribute filtering in directory search queries

Question 6

During an incident response engagement involving a web application, an analyst uncovers evidence of Command Injection. Which TWO indicators or technical conditions strongly support this specific finding? (Choose TWO)

Accepted Answer

Presence of shell metacharacters like pipes, ampersands, or semicolons within HTTP parameter values. Command injection occurs when untrusted user input is passed directly to operating system shell interpreters via functions like system() or popen(). Analysts look for shell metacharacters such as pipes or semicolons in access logs alongside process creation anomalies indicating spawned subprocesses.

Answer

Database error logs displaying syntax violations from unmatched table column counts

Answer

Application configuration files storing plaintext database connection passwords

Answer

Client-side DOM manipulation errors logged within browser developer console windows

Question 7

An incident investigator reviews application logs showing that an attacker manipulated session tokens by altering underlying JSON Web Tokens without knowing the signing secret. The attacker successfully forged valid-looking administrative sessions. Which server-side vulnerability enabled this behavior?

Accepted Answer

Improper JWT algorithm validation permitting the 'none' signing algorithm. Accepting JSON Web Tokens with the algorithm header set to 'none' is a critical cryptographic misconfiguration. When developers fail to enforce strict algorithm validation on the server side, attackers can strip cryptographic signatures entirely, modify payload claims, and gain unauthorized administrative privileges.

Answer

Server-Side Request Forgery via unvalidated webhook URLs

Answer

SQL injection within the session lookup table query

Answer

Cross-Site Scripting enabling session identifier theft from local storage

Question 8

Which TWO of the following techniques are most effective for preventing Cross-Site Scripting (XSS) in a web application?

Accepted Answer

Using contextual output encoding.. Preventing XSS requires a multi-layered defense strategy focused on output handling. Encoding converts potentially dangerous characters into safe representations, preventing the browser from executing them as script code. Content Security Policy provides a powerful browser-side mechanism to restrict script execution sources. These two methods combined address both the immediate rendering risk and the long-term architectural risk of malicious scripts being injected into the DOM or executed from unauthorized domains.

Answer

Enforcing HTTPS for all application traffic.

Answer

Disabling JavaScript in the web browser.

Answer

Using basic regex to filter out script tags.

Question 9

Refer to the exhibit. An application reflects user input directly into the HTML value attribute. What type of vulnerability is present?

Accepted Answer

Reflected Cross-Site Scripting (XSS). The exhibit shows input being reflected back into the HTML attribute without proper sanitization. This is a classic example of Reflected Cross-Site Scripting (XSS). Because the input is rendered inside a tag attribute, an attacker can break out of the context using quotes to execute arbitrary JavaScript. This highlights the danger of rendering untrusted input, requiring rigorous encoding or validation strategies to ensure the browser interprets data as literal text.

Answer

SQL Injection

Answer

Command Injection

Answer

Insecure Direct Object Reference (IDOR)

Question 10

Which of the following describes the primary danger of an Insecure Deserialization vulnerability in a web application?

Accepted Answer

It facilitates the execution of arbitrary code via gadget chains.. Insecure deserialization occurs when untrusted data is used to abuse the logic of an application, inflict a DoS, or execute arbitrary code. By manipulating the serialized object, an attacker can modify application state, bypass authentication, or leverage existing application code (gadget chains) to gain remote code execution. This is critical because modern frameworks often automatically deserialize objects from user-provided data without sufficient verification or integrity checks on the source.

Answer

The vulnerability enables unauthorized database password decryption.

Answer

It allows attackers to inject malicious code into the database.

Answer

It causes the application to leak internal memory structures.

Question 11

What is the primary difference between Stored XSS and Reflected XSS?

Accepted Answer

Stored XSS permanently persists in the application, while Reflected XSS is transient.. The difference lies in the persistence of the payload. Stored XSS injects malicious code into the server's database or permanent storage, meaning every user viewing that page is automatically affected. Reflected XSS requires the victim to click a specially crafted link that includes the payload, which is then reflected back in the response. Understanding this distinction is vital for incident response, as Stored XSS implies a compromise of data integrity and wider impact.

Answer

Stored XSS uses server-side scripts, whereas Reflected XSS uses client-side scripts.

Answer

Reflected XSS is stored on the server, while Stored XSS is delivered via URLs.

Answer

Reflected XSS is more dangerous because it bypasses CSRF tokens.

Question 12

Refer to the exhibit. If an attacker successfully injects into a page, what happens?

Accepted Answer

The browser blocks the script and logs a violation.. The CSP policy explicitly permits only scripts from the application's own origin ('self') and from the trusted CDN. Because the injected inline script does not match these sources, the browser will block its execution. This is a crucial security control because it forces the developer to rely on external files, rendering traditional inline XSS payloads useless. It effectively mitigates the risk by ensuring only scripts from trusted, verified locations can run.

Answer

The script executes successfully.

Answer

The browser executes the script only if the user is an admin.

Answer

The browser automatically strips the script tags.

Question 13

When evaluating potential SQL injection in an application, what is the most significant indicator that an application is vulnerable?

Accepted Answer

User input is directly concatenated into a query string.. The most definitive indicator is the presence of dynamic SQL construction using unsanitized user input. When developers concatenate strings to build queries, the database cannot distinguish between data and command intent. Identifying code patterns where user parameters are directly appended to a SQL string is a critical step in security assessments. This practice allows attackers to manipulate the query structure, leading to unauthorized data exposure, bypasses, or administrative actions within the database management system.

Answer

The application uses a relational database management system.

Answer

The database contains sensitive user data.

Answer

The application is written in an interpreted language.

Question 14

An incident responder investigates a web application breach where an attacker successfully extracted sensitive user data by appending UNION SELECT statements to a numeric product ID parameter. Which backend remediation approach directly eliminates this vulnerability class while preserving application functionality?

Accepted Answer

Refactor database queries to use prepared statements with bound parameters via the application data access layer.. Parameterized queries decouple user-supplied input from the SQL command structure, ensuring the database engine treats input exclusively as data rather than executable code. Implementing parameterized queries globally stops SQL injection by neutralizing untrusted input regardless of characters appended by attackers, making it the definitive defense for database interaction security in incident response hardening.

Answer

Implement client-side JavaScript regex validation to strip SQL keywords from input parameters before transmission.

Answer

Wrap all user inputs inside custom string-escaping functions designed to neutralize single quotes and semicolons.

Answer

Deploy a traditional network firewall configured with signature rules to block incoming HTTP GET requests containing UNION.

Question 15

An incident handler is analyzing a severe Cross-Site Scripting (XSS) incident where malicious JavaScript stole administrator session cookies. Which TWO of the following defensive configurations and practices effectively mitigate session theft risks via XSS?

Accepted Answer

Set the HttpOnly flag on all sensitive authentication and session cookies.. Applying the HttpOnly flag prevents client-side scripts from accessing sensitive cookies via document.cookie, stopping direct session hijacking even if XSS exists. Combining this with a strong Content Security Policy restricts where scripts load and execute, providing defense-in-depth against malicious script injection attempts.

Answer

Require strict TLS 1.3 encryption for all incoming and outgoing web traffic sessions.

Answer

Store user session tokens inside local storage rather than standard browser cookies.

Answer

Encode all dynamic output using generic HTML entity encoding routines on the server side.

Question 16

During a web application penetration test, an assessor discovers an endpoint vulnerable to OS Command Injection via an improperly sanitized ping utility parameter. Which TWO remediation strategies provide robust defense against command injection vulnerabilities?

Accepted Answer

Replace shell execution wrappers with native language libraries or built-in functions designed for the specific task.. Replacing insecure OS command execution functions with native language libraries or APIs completely avoids invoking the underlying operating system shell. When OS execution is strictly necessary, passing arguments as a fixed array rather than a concatenated string prevents shell metacharacter interpretation.

Answer

Apply strict input validation blacklists to filter out dangerous shell operators such as semicolons, pipes, and ampersands.

Answer

Configure the web server process to run with elevated root privileges to ensure access to system binaries.

Answer

Encode all user inputs using URL encoding standards before passing parameters into system shell execution functions.

Question 17

An incident responder analyzes a web application log and discovers that an attacker successfully extracted database schema names by manipulating a parameter where the application dynamically constructs SQL statements. The database error messages returned verbose structural details. Which remediation strategy provides the most robust defense against this injection vector while maintaining application functionality?

Accepted Answer

Refactor the data access layer to utilize parameterized queries and prepared statements exclusively.. Parameterized queries decouple user-supplied input from the SQL command structure, ensuring the database engine interprets data strictly as parameters rather than executable code. This eliminates SQL injection vulnerabilities at the architectural level, regardless of input complexity or encoding techniques, protecting the underlying database management system from unauthorized data access and structural enumeration.

Answer

Implement client-side JavaScript validation checks to strip dangerous SQL characters before submission.

Answer

Configure the web application firewall to block requests containing common SQL keywords like UNION and SELECT.

Answer

Disable verbose database error messages globally to prevent attackers from viewing schema details.

Question 18

An incident handler is reviewing WAF logs and notices repeated HTTP requests to a web application where the 'Host' header contains an attacker-controlled domain, while the request line targets the legitimate application server. The application uses the Host header to construct password-reset links emailed to users. Which web application injection attack class BEST describes this activity?

Accepted Answer

HTTP Host header injection leading to password reset poisoning. The attacker exploits the application's trust in the Host header to generate password-reset links. By setting the Host header to an attacker-controlled domain, the reset email contains a link pointing to that domain, allowing token theft. This is a classic Host header injection attack, distinct from CSRF, SSRF, and response splitting.

Answer

HTTP response splitting through CRLF injection in the Host header

Answer

Cross-Site Request Forgery (CSRF) against the password reset endpoint

Answer

Server-Side Request Forgery (SSRF) via the password reset functionality

Question 19

An incident handler is investigating a web application that uses a NoSQL database (MongoDB). The attacker sent a request with the parameter 'username[$ne]=admin&password[$ne]=wrong' and successfully authenticated as an administrator. Which of the following BEST describes the attack technique used?

Accepted Answer

NoSQL injection via operator injection in MongoDB query selectors. The attacker exploited the application's failure to sanitize user input before incorporating it into a MongoDB query. By injecting the $ne operator, the attacker changed the query to return a user record where the username and password are not equal to the supplied values, bypassing authentication. This is a classic NoSQL injection attack.

Answer

SQL injection using MongoDB's SQL compatibility layer

Answer

Cross-Site Scripting (XSS) through unsanitized input in the login form

Answer

LDAP injection exploiting the authentication backend

Question 20

A GCIH analyst is reviewing web server logs and sees repeated requests to /search?q=... where the q parameter contains strings like ../../../etc/passwd and ....//....//etc/shadow. The responses include root:x:0:0 entries. The application is a Java servlet that concatenates a user-supplied filename onto a base directory before calling new File(baseDir + userInput). Which vulnerability class best describes this incident?

Accepted Answer

Path Traversal. The attacker manipulates a filename parameter to escape the intended directory using ../ sequences and reads /etc/passwd, which is the defining behavior of Path Traversal. The vulnerable Java code concatenates user input onto a base path without canonicalization or validation, allowing the traversal. SSRF, LFI, and XXE each involve different mechanisms and would not produce this specific log pattern.

Answer

XML External Entity (XXE) injection

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)