PEN-200 Web Application Attacks — 10 Questions

Question 1

During a web assessment, you identify an input field that reflects user-supplied data directly into a JavaScript context within a script tag. What is the most effective approach to achieve Cross-Site Scripting (XSS) in this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inject a semicolon followed by a JavaScript function call to terminate the previous statement.. Injecting into a script block requires breaking out of the current string definition using characters like quotes and semicolons. Once the context is escaped, you can terminate the current command and inject arbitrary JavaScript. This scenario highlights the importance of context-aware output encoding, as standard HTML entity encoding often fails to prevent execution when data is placed inside existing executable blocks, leading to high-impact client-side attacks.

Answer

Submit a standard HTML payload like without closing existing strings.

Answer

Use URL encoding for all characters to bypass the server-side Web Application Firewall filters.

Answer

Wrap the payload in <img> tags with an onerror event handler.

Question 2

Which TWO of the following payloads would successfully confirm a UNION-based SQL Injection vulnerability in this specific PHP code snippet?

Accepted Answer

id=1 UNION SELECT 1,2-- -. The vulnerable code concatenates user input directly into the query, allowing for UNION-based injection. By appending a UNION statement, an attacker can append results from other tables. Identifying the correct column count is critical; these payloads demonstrate how to align data types and column numbers to successfully extract sensitive information from the backend database, a common objective when escalating access during an authorized penetration test.

Answer

id=1 AND 1=1

Answer

id=1 ORDER BY 3-- -

Answer

id=1' OR '1'='1

Question 3

Given this configuration, what is the most likely outcome when an attacker triggers an unhandled exception in the application from an external IP address?

Accepted Answer

The attacker will see the page specified in the defaultRedirect attribute.. The 'RemoteOnly' mode ensures that detailed error information is only displayed to requests originating from the local loopback address. For external users, the application redirects to a generic error page, hiding stack traces and internal path information. This configuration is a security control designed to prevent information leakage, forcing the attacker to find alternative methods for error discovery or fingerprinting the application environment.

Answer

The attacker will receive a detailed stack trace revealing server-side paths.

Answer

The application will crash and terminate the service process immediately.

Answer

The server will return a 403 Forbidden status code to the attacker.

Question 4

When auditing an application for Insecure Direct Object Reference (IDOR) vulnerabilities, which THREE actions should you perform to identify potential flaws?

Accepted Answer

Change a numeric ID in a GET request to see if data belonging to another user is returned.. IDOR vulnerabilities occur when applications expose internal object references, such as database keys, without verifying user authorization. Identifying these requires observing patterns in URL parameters, testing access control boundaries between different user roles, and attempting to manipulate identifiers. Systematic testing confirms whether an application relies on 'security by obscurity'—hoping users won't guess IDs—rather than enforcing proper server-side access controls.

Answer

Injecting into all input fields to test for reflection.

Answer

Test if changing a user's role in the session cookie gives administrative access.

Question 5

You are auditing an application and suspect it is vulnerable to XML External Entity (XXE) injection. Which THREE of the following are appropriate methods to confirm this vulnerability?

Accepted Answer

Defining an external entity that points to /etc/passwd and referencing it in the document.. XXE occurs when XML parsers are configured to process external entities, allowing attackers to access local files or perform SSRF. Confirming XXE requires inducing the parser to resolve malicious entity references. By testing for out-of-band communication or local file retrieval, you can verify if the parser is misconfigured to handle DTDs, which is critical for securing applications that process untrusted XML data.

Answer

Uploading a file with a .php extension to the profile picture upload field.

Answer

Using a payload that triggers a recursive entity expansion for Denial of Service.

Question 6

During an internal penetration test, an operator discovers a file upload feature on a target web application. The application attempts to restrict uploads by verifying the file extension against a hardcoded list on the server side. Which technique represents the most effective methodology to bypass this extension-based restriction during a web assessment?

Accepted Answer

Inject a URL-encoded null byte followed by a safe extension to terminate the string early in vulnerable underlying filesystem APIs.. Appending a null byte (%00) or leveraging multi-extension behaviors in legacy web servers can trick the backend validation logic while executing the desired payload. Understanding how web servers handle file parsing discrepancies is crucial for achieving Remote Code Execution during comprehensive assessments.

Answer

Modify the Content-Type header in the HTTP request to image/jpeg while uploading a PHP webshell with a standard extension.

Answer

Rename the file to use double extensions such as shell.php.jpg and rely on the default web server configuration to execute the first parsed extension.

Answer

Encode the entire filename using Base64 within the multipart form-data boundary to obfuscate the forbidden extension from the regex engine.

Question 7

You are auditing a file upload feature that restricts uploaded files based solely on extension blacklisting and client-side JavaScript validation. Which TWO techniques can you use to bypass these controls and achieve remote code execution on a Linux-based web server?

Accepted Answer

Uploading a file with an alternative executable extension such as .php5 or .phtml that is still processed by the backend web server. Bypassing weak file upload filters requires exploiting server-side parsing weaknesses or manipulating the transmission data. Since client-side validation is easily circumvented by intercepting requests with an HTTP proxy, testers must focus on server-side extension handling discrepancies and path traversal flaws to place executable scripts in web-accessible directories.

Answer

Modifying the client-side JavaScript validation function in the browser developer tools to allow PHP file extensions before submission

Answer

Modifying the Content-Type header in the HTTP request from application/octet-stream to text/plain to satisfy server-side MIME type checks

Answer

Disabling JavaScript completely in your browser settings to prevent the upload form from performing any input sanitization

Question 8

Refer to the exhibit. During a web application assessment, you intercept this login request and suspect it may be vulnerable to Parameter Pollution. Which behavior confirms that HTTP Parameter Pollution is present and successfully alters the application logic?

Accepted Answer

Appending an extra &debug=false parameter causes the application to evaluate the second value and disable administrative debugging features. HTTP Parameter Pollution occurs when an application processes multiple parameters with the same name differently depending on the underlying web technology or custom parsing logic. Confirming this vulnerability requires observing how the application handles duplicate parameter keys, such as prioritizing the first instance, the last instance, or concatenating them together into a single string.

Answer

The server responds with a 403 Forbidden status code because duplicate parameter names violate RFC specifications for HTTP request syntax

Answer

The web application crashes and returns a stack trace indicating an unhandled array index out of bounds exception in the request parser

Answer

The server automatically strips all trailing parameter assignments from the request body and processes only the initial authentication credentials

Question 9

During a web application assessment, you find that the login form accepts a username and password and returns a JWT in the response body. The JWT header is {"alg":"HS256","typ":"JWT"}. You capture a token and attempt to modify the "role" claim from "user" to "admin", but the signature verification fails. Which of the following actions is the most appropriate next step to test for a JWT algorithm confusion vulnerability?

Accepted Answer

Change the "alg" header to "RS256", obtain the public key, and sign the modified token using the public key as an HMAC secret.. Algorithm confusion in JWT occurs when a server expects an asymmetric algorithm like RS256 but a library accepts a symmetric algorithm like HS256. An attacker can change the alg header to RS256 and sign the token with the public key as an HMAC secret, potentially bypassing verification. This allows forging tokens with elevated privileges, such as changing the role claim to admin.

Answer

Brute-force the HMAC secret using a wordlist and then re-sign the modified token with the recovered key.

Answer

Change the "alg" header to "none" and remove the signature portion of the token, then replay the request.

Answer

Intercept the token and modify the "kid" header to point to a known file on the server, then sign with a self-generated key.

Question 10

You are testing a web application that uses a search function. When you enter a single quote in the search box, the application returns a database error. You suspect SQL injection. Which of the following payloads would best confirm a UNION-based SQL injection vulnerability by retrieving the database version, assuming a MySQL backend and that the original query returns three columns?

Accepted Answer

' UNION SELECT 1, version(), 3 -- -. A UNION-based SQL injection requires matching the number of columns in the original query. The payload ' UNION SELECT 1, version(), 3 -- - appends a SELECT statement with three columns, using version() to retrieve the MySQL version. The comment sequence -- - ensures the rest of the original query is ignored. If the application displays the version, the vulnerability is confirmed.

Answer

' AND 1=1 -- -

Answer

' OR 1=1 -- -

Answer

' UNION SELECT @@version, 2, 3 -- -