NEW
Font size
WorksheetsWAPT 2 - Up to XPATH
Total questions: 42
Worksheet time: 21mins
What is the main characteristic of in-band SQL injection?
It uses a separate channel for injecting and retrieving data.
It exploits vulnerabilities without returning errors to the attacker.
It uses the same communication channel for both injection and data retrieval.
It manipulates stored procedures only.
Which of the following SQL clauses is commonly used in UNION-based SQL injection?
SELECT INTO
UNION SELECT
DELETE FROM
INSERT INTO
What is the defining feature of blind SQL injection?
The attacker directly views the results of the injected query.
The database responses are used to infer information indirectly.
The attack relies solely on error messages.
It only works with stored procedures.
In boolean-based blind SQL injection, how is information extracted?
By observing server-side boolean responses like true or false.
By injecting multiple UNION SELECT queries.
By accessing error messages from the database.
By directly reading the database output.
Which method is commonly used in time-based blind SQL injection?
DELAY queries to measure the server's response time.
UNION SELECT queries for data extraction.
Error messages for debugging SQL injections.
Stored procedure execution to retrieve data.
What type of queries are typically used to extract information in time-based SQL injection?
Logical operations.
WAITFOR DELAY commands.
INSERT commands.
UPDATE queries.
How can SQL injection lead to remote code execution (RCE)?
By injecting SQL commands that interact with the file system or operating system.
By accessing the database directly without executing commands.
By bypassing authentication alone.
By exploiting stored procedures to modify data.
Which stored procedure is often exploited for RCE through SQL injection?
sp_configure
sp_helpindex
sp_table_privileges
sp_addtype
What does SSTI stand for?
Server-Side Template Injection.
Server-Side Traffic Interception.
Secure Session Template Injection.
Secure Server Token Injection.
Which server-side template engine is commonly vulnerable to SSTI attacks?
Django Templates
Jinja2
ReactJS
Handlebars
What is a common payload used in SSTI attacks?
{{7*7}}
[[7*7]]
(7*7)
How can SSTI lead to RCE?
By injecting code that gets executed in the template engine's context.
By manipulating the server's HTTP response headers.
By modifying the client's browser behavior.
By injecting scripts in HTML templates only.
What does JWT stand for?
JSON Web Token.
Java Web Template.
JavaScript Web Token.
JSON Widget Token.
Which algorithm is commonly used to sign JWTs?
SHA-256
MD5
AES
RSA
What is a critical vulnerability in JWT implementation?
Using weak encryption for the payload.
Allowing the 'none' algorithm for signing.
Storing the JWT on the server.
Using base64 encoding for the payload.
How can an attacker forge a JWT token?
By tampering with the signature without validation.
By modifying the payload if the 'none' algorithm is enabled.
By injecting SQL queries into the token.
By brute-forcing the user's password.
What is insecure deserialization?
The process of safely storing data in a database.
Exploiting deserialization to execute unintended commands.
Using encrypted tokens for user authentication.
Preventing injection attacks in templates.
Which of the following objects is commonly exploited during insecure deserialization?
Serialized objects from trusted sources.
Serialized objects from untrusted sources.
JWT tokens.
SQL queries.
How can an attacker exploit insecure deserialization to achieve RCE?
By injecting a serialized payload containing malicious code.
By brute-forcing the deserialization process.
By tampering with server-side templates.
By bypassing authentication.
Which security measure helps prevent insecure deserialization?
Validating input fields in forms.
Using strong encryption for data storage.
Implementing strict input validation and avoiding deserialization of untrusted data.
Disabling error messages.
What does SSRF stand for?
Server-Side Request Forgery.
Secure Server Resource Framework.
Server-Side Remote Framework.
Secure Server Request Functionality.
What is the main purpose of an SSRF attack?
To inject SQL commands into the database.
To force the server to make unauthorized requests to internal or external resources.
To manipulate the server's HTML templates.
To bypass client-side input validation.
Which of the following is an example of a successful SSRF attack?
Accessing internal server files using `file:///` protocol.
Bypassing CAPTCHA verification on the client-side.
Intercepting traffic between the client and the server.
Stealing user credentials via phishing.
How can SSRF be mitigated?
By using parameterized queries in database operations.
By validating and restricting URL inputs to allow only safe destinations.
By disabling all server-side templates.
By encrypting user sessions.
What is XPath injection?
A type of attack targeting SQL databases.
Exploiting vulnerabilities in XML Path Language queries.
Injecting malicious payloads into server-side templates.
Manipulating serialized data to execute commands.
Which of the following is a vulnerable XPath query example?
/users/user[username=$input]
SELECT * FROM users WHERE username='$input'
{{user.name}}
file_get_contents($_GET['file']);
How does an attacker exploit an XPath injection vulnerability?
By injecting malicious XPath expressions to retrieve or modify unauthorized data.
By brute-forcing the user's credentials in the application.
By tampering with session cookies to gain access.
By embedding scripts in SQL queries.
What type of data is commonly targeted in XPath injection attacks?
JSON data from APIs.
XML data stored in a server or database.
SQL database records.
Serialized object files.
How can XPath injection be prevented?
By disabling XML processing on the server.
By validating and sanitizing user inputs used in XPath queries.
By using encrypted JWT tokens for authentication.
By implementing strict HTTP request headers.
Which of the following payloads could be used to bypass authentication in an XPath query?
admin' OR '1'='1
1' or '1'='1
SELECT * FROM users
file:///etc/passwd
What is the primary difference between time-based and boolean-based blind SQL injection?
Time-based relies on data retrieval from errors, while boolean-based uses HTTP responses.
Time-based uses server delays to infer data, while boolean-based relies on logical conditions.
In time-based blind SQL injection, what kind of SQL payload is used to test vulnerabilities?
Payloads that exploit UNION queries.
Payloads that trigger server delays using SQL functions like SLEEP().
Payloads that generate detailed error messages.
Payloads that directly display data in the browser.
Which of the following is an example of a time-based blind SQL injection payload?
SELECT * FROM users WHERE id=1 AND SLEEP(5);
SELECT username FROM users WHERE id='1' OR '1'='1';
UNION SELECT NULL, username, password FROM users;
file:///etc/passwd
How can blind SQL injection vulnerabilities be mitigated?
By using complex SQL queries for data processing.
By ensuring proper input validation and using parameterized queries.
What is command injection?
Injecting SQL queries to manipulate databases.
Injecting malicious commands into a vulnerable application to execute on the server.
Which of the following payloads could be used in a command injection attack?
; ls -la
{{7*7}}
../etc/passwd
SELECT * FROM users
What is a common vector for command injection?
Input fields that pass unsanitized data to system commands.
SQL queries vulnerable to injection.
