WorksheetsVulnerability Website
Total questions: 10
Worksheet time: 15mins
What is a common payload used for testing SQL Injection vulnerabilities?
'; DROP TABLE users; -
<script>alert('SQL Injection');</script>
%27%20OR%201%3D1%20--
SELECT * FROM users WHERE username = 'admin' AND password = 'password'
Which of the following best describes OS command injection?
A method used to inject malicious code into a website's database
A vulnerability that allows attackers to execute arbitrary commands on a server's operating system
A technique for bypassing firewalls to gain unauthorized access to a network
A security measure implemented to prevent buffer overflow attacks
Which file extensions pose potential risks if uploaded by users?
.exe, .php, .bat
.jpg, .png, .gif
.txt, .pdf, .docx
.html, .css, .js
Which of the following is not a protection against a brute force password attack?
Implementing account lockout policies after a certain number of failed login attempts
Using strong and complex passwords that are difficult to guess
Employing multi-factor authentication to add an extra layer of security
Regularly updating and patching software to address potential vulnerabilities
What is a possible consequence of Cross-Site Scripting (XSS) attacks?
Alteration of server-side database entries.
Compromise of system files on the server.
Elevation of user privileges within the application.
Execution of malicious scripts within the victim's browser.
What is a potential risk associated with weak session IDs in web applications?
Allowing attackers to execute arbitrary code on the server.
Facilitating cross-site scripting (XSS) attacks.
Enabling session hijacking and unauthorized access to user accounts.
All correct.
What is a characteristic of a race condition attack in computer security?
Exploiting vulnerabilities in cryptographic algorithms.
Manipulating timing or sequence of events to gain unauthorized access.
Generating excessive network traffic to overwhelm system resources.
Intercepting and decrypting encrypted communication between two parties.
What is the key difference between Local File Inclusion (LFI) and Remote File Inclusion (RFI)?
LFI allows an attacker to include and execute files that are already present on the target system, while RFI allows the inclusion and execution of files hosted on remote servers.
LFI occurs when an attacker injects malicious code into a website's input fields, while RFI involves exploiting vulnerabilities in server-side scripts to include external files.
LFI relies on exploiting server misconfigurations, while RFI takes advantage of weaknesses in client-side authentication mechanisms.
LFI targets web servers running specific operating systems, while RFI targets web applications built on specific programming languages.
What is a key aspect of Server-Side Request Forgery (SSRF) attacks?
Exploiting weaknesses in client-side authentication mechanisms.
Leveraging vulnerabilities in server-side scripting languages.
Intercepting and decrypting encrypted data transmitted between client and server.
Manipulating requests sent by the server to access internal resources.
Which scenario best exemplifies Cross-Site Request Forgery (CSRF)?
A user unintentionally installs malware on their computer, allowing remote attackers to intercept their web traffic and manipulate their online interactions.
A website administrator unknowingly inserts malicious code into their website's login form, enabling attackers to capture users' login credentials.
An attacker crafts a malicious web page with embedded code that, when visited by the victim while logged into a social media platform, posts unauthorized content on the victim's profile.
No correct answer.
