I85PREP
⌘ K
eWPT study materials
eWPT study resources

eWPT practice questions

One question at a time. Build your eWPT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web Application Penetration Testing

During reconnaissance on a target web application, a tester observes that the server returns a Set-Cookie header with the attribute HttpOnly missing. What is the primary security implication of this observation?

  1. The cookie is automatically scoped to the root path of the domain
  2. Client-side JavaScript can read the cookie, increasing exposure to theft via XSS Correct answer.
  3. The cookie cannot be transmitted over plaintext HTTP connections
  4. The cookie value is encrypted and therefore unreadable to attackers

Explanation

The HttpOnly attribute instructs the browser to hide the cookie from the document.cookie API, so omitting it allows scripts running in the origin to read the value. If an attacker achieves script execution through cross-site scripting, the session token can be exfiltrated and replayed. HttpOnly is a defense-in-depth control against session hijacking via XSS.

Question 2Web Application Penetration Testing

A tester submits the payload `<script>alert(document.domain)</script>` into a search field, and the value is reflected verbatim inside the HTML body of the response without encoding. Which vulnerability class is most directly demonstrated?

  1. SQL injection
  2. Server-side request forgery
  3. Stored cross-site scripting
  4. Reflected cross-site scripting Correct answer.

Explanation

Reflected XSS occurs when user-supplied input is immediately returned in the response and interpreted by the browser as executable markup. Because the payload is not persisted and only appears in the direct response, it is classified as reflected rather than stored. The absence of output encoding is the root cause.

Question 3Web Application Penetration Testing

While testing a login form, a tester enters `admin' OR '1'='1` in the username field and is authenticated without valid credentials. Which weakness does this most likely indicate?

  1. Weak password hashing algorithm
  2. Missing rate limiting on authentication
  3. Improper neutralization of special elements in SQL queries Correct answer.
  4. Insecure direct object reference

Explanation

The payload alters the query's boolean logic by injecting a tautology, which indicates the input is concatenated into a SQL statement without parameterization. The correct fix is to use prepared statements with bound parameters. The other options do not explain authentication bypass through query manipulation.

Question 4Web Application Penetration Testing

Which HTTP response header is most effective at mitigating clickjacking by preventing the page from being framed by other origins?

  1. Content-Security-Policy: default-src 'self'
  2. Content-Security-Policy: frame-ancestors 'self' Correct answer.
  3. Strict-Transport-Security: max-age=31536000
  4. X-Content-Type-Options: nosniff

Explanation

The frame-ancestors directive in CSP controls which origins may embed the page in a frame, directly mitigating clickjacking. The legacy X-Frame-Options header achieves a similar goal but is superseded by frame-ancestors. Other headers address different concerns such as resource loading, MIME sniffing, or transport security.

Question 5Web Application Penetration Testing

A tester inspects a URL of the form `/invoice?id=1042` and changes the value to `1041`, receiving another user's invoice. Which vulnerability is present?

  1. Open redirect
  2. Insecure direct object reference Correct answer.
  3. XML external entity injection
  4. Cross-site request forgery

Explanation

IDOR occurs when an application exposes an internal object identifier and fails to verify that the requesting user is authorized to access that object. Changing the identifier to another user's value returns their data, confirming missing authorization checks. The remedy is server-side access control on every object reference.

Question 6Web Application Penetration Testing

Which tool is specifically designed for intercepting and modifying HTTP/S traffic between a browser and a web server during manual testing?

  1. Nmap
  2. Burp Suite Proxy Correct answer.
  3. Nikto
  4. Wireshark

Explanation

An intercepting proxy such as Burp Suite Proxy sits between the client and server, allowing the tester to pause, inspect, and modify requests and responses. This capability is central to manual web application testing. The other tools serve different purposes like port scanning, packet capture, or automated scanning.

Question 7Web Application Penetration Testing

When reviewing an application, a tester finds that session identifiers are generated using a predictable incrementing counter. What is the most significant risk?

  1. The session store will consume excessive memory
  2. Attackers can predict and forge valid session identifiers Correct answer.
  3. Users will be forced to change passwords frequently
  4. The application will fail to set cookies over HTTPS

Explanation

Session tokens must be generated using a cryptographically secure random number generator with sufficient entropy. A predictable counter lets an attacker enumerate or guess valid tokens and hijack sessions. Randomness is the core property that prevents token prediction.

Question 8Web Application Penetration Testing

A tester observes that the application returns detailed stack traces and database error messages when malformed input is submitted. Which testing principle does this finding most directly violate?

  1. Separation of duties
  2. Defense in depth
  3. Secure error handling and information disclosure prevention Correct answer.
  4. Principle of least privilege

Explanation

Verbose error messages leak implementation details such as framework versions, file paths, and query structure that aid attackers. Secure error handling returns generic messages to users while logging detail server-side. This is a classic information disclosure finding.

Question 9Web Application Penetration Testing

A tester wants to determine whether a parameter is vulnerable to blind SQL injection when no data is reflected in the response. Which technique is most appropriate?

  1. Submitting a payload that causes a deliberate time delay conditionally Correct answer.
  2. Changing the HTTP method from GET to OPTIONS
  3. Sending a payload containing `<script>` tags
  4. Requesting the robots.txt file

Explanation

Time-based blind SQL injection infers truth from response timing, for example by triggering a database sleep only when a condition is true. This allows data extraction even when no output is reflected. Boolean-based inference is a related alternative when response content differs.

Question 10Web Application Penetration Testing

An application stores user-uploaded files and serves them from the same origin with the original filename and extension. A tester uploads a `.php` file containing executable code. What is the primary risk if the server executes uploaded scripts?

  1. Cross-site request forgery against administrators
  2. Reflected cross-site scripting in the upload form
  3. Session fixation through cookie reuse
  4. Remote code execution on the web server Correct answer.

Explanation

Unrestricted file upload that permits executable extensions can lead to remote code execution when the server processes the uploaded file. Mitigations include extension allowlisting, content-type validation, storing files outside the webroot, and disabling execution in upload directories. This is among the most severe web vulnerabilities.

Question 11Web Application Penetration Testing

During testing, a tester submits an XML document containing a DOCTYPE declaration with an external entity referencing `/etc/passwd`. The response includes the file contents. Which vulnerability is confirmed?

  1. Insecure deserialization
  2. HTTP request smuggling
  3. XML external entity injection Correct answer.
  4. Server-side template injection

Explanation

XXE occurs when an XML parser resolves external entities declared in a document, allowing local file disclosure or SSRF. The fix is to disable external entity processing and DTDs in the parser configuration. The observed file read confirms the parser is resolving attacker-controlled entities.

Question 12Web Application Penetration Testing

A tester finds that the application's password reset endpoint accepts a `Host` header value controlled by the client and uses it to build the reset link sent by email. Which attack does this enable?

  1. SQL injection in the reset query
  2. Cross-site scripting in the login page
  3. Password reset token leakage via host header injection Correct answer.
  4. Denial of service through header flooding

Explanation

If the reset link is built from an untrusted Host header, an attacker can cause the victim to receive a link pointing to an attacker-controlled domain, capturing the reset token. Applications should use a configured canonical hostname for link generation. This is a form of host header injection.

Question 13Web Application Penetration Testing

A tester observes that an application accepts a JWT and does not verify the signature, accepting tokens with the algorithm set to `none`. What is the most direct consequence?

  1. Attackers can forge tokens with arbitrary claims Correct answer.
  2. Tokens expire prematurely
  3. The token payload is encrypted by default
  4. The application rejects all bearer tokens

Explanation

When signature verification is skipped or the `none` algorithm is accepted, an attacker can craft tokens with any claims, such as an elevated role. The server must enforce a strict algorithm allowlist and always verify the signature. This is a well-known JWT implementation flaw.

Question 14Web Application Penetration Testing

Which of the following best describes the purpose of the `SameSite=Strict` cookie attribute?

  1. It encrypts the cookie value in transit
  2. It prevents the cookie from being sent on cross-site requests, reducing CSRF exposure Correct answer.
  3. It restricts the cookie to HTTPS connections only
  4. It extends the cookie lifetime beyond the browser session

Explanation

SameSite=Strict instructs the browser to withhold the cookie on requests initiated from other sites, which mitigates cross-site request forgery. Lax allows top-level navigations, while Strict blocks all cross-site sending. It is a browser-enforced control, not encryption or transport security.

Question 15Web Application Penetration Testing

A tester discovers that the application's authorization check compares the user's role using a client-side cookie value that is base64-encoded but not signed. What is the most reliable way to confirm privilege escalation?

  1. Send the cookie over HTTP to see if it is rejected
  2. Request the robots.txt file to find admin paths
  3. Change the role value in the cookie and observe whether administrative functions become accessible Correct answer.
  4. Delete the cookie and check for a 500 error

Explanation

Because the cookie is unsigned, the tester can modify the role value and observe whether the server trusts it for authorization. If administrative functionality becomes accessible, privilege escalation is confirmed. The fix is to enforce authorization server-side based on trusted session data.

Question 16Web Application Penetration Testing

Which technique is used to detect server-side template injection in a parameter that is rendered into a page?

  1. Submitting `<script>alert(1)</script>` and checking for a dialog
  2. Submitting arithmetic expressions like `{{7*7}}` and checking for evaluated output Correct answer.
  3. Submitting `' OR 1=1--` and checking for authentication bypass
  4. Submitting `../../etc/passwd` and checking for file contents

Explanation

SSTI is detected by injecting template syntax and observing whether the engine evaluates it, such as rendering 49 for `{{7*7}}`. Different engines use different delimiters, so testers probe multiple syntaxes. Confirmation distinguishes template evaluation from simple reflection.

Question 17Web Application Penetration Testing

A tester observes that an application reflects the value of the `Referer` header into an HTML attribute without encoding, and the attribute is later used in a JavaScript context. Which mitigation most directly addresses the root cause?

  1. Implementing rate limiting on requests
  2. Context-aware output encoding of untrusted data Correct answer.
  3. Enabling HSTS on the server
  4. Adding the HttpOnly attribute to cookies

Explanation

The root cause is that untrusted data is placed into an output context without proper encoding. Context-aware encoding ensures that characters are escaped appropriately for HTML, attribute, or JavaScript contexts, preventing script execution. Other controls do not address output handling.

Question 18Web Application Penetration Testing

A tester is assessing an API endpoint that returns data based on a `Content-Type` of `application/json`. The tester changes the content type to `application/xml` and the server parses the body as XML. Which class of vulnerability does this behavior suggest?

  1. Session fixation
  2. Cross-site tracing
  3. HTTP response splitting
  4. Content-type confusion enabling XML-based attacks Correct answer.

Explanation

If the server switches parsers based on the client-supplied content type, an attacker may introduce XML parsing and potentially XXE or parser-specific attacks. The server should enforce an expected content type and reject mismatches. This is a form of content-type confusion.

Question 19Web Application Penetration Testing

A tester finds that the application uses sequential numeric order identifiers in a REST API and exposes the `/api/orders/{id}` endpoint. Which control should be verified to prevent unauthorized access to other users' orders?

  1. Server-side authorization checks on each object reference Correct answer.
  2. Client-side validation of the identifier format
  3. Obfuscation of identifiers using base64 encoding
  4. Removal of the Authorization header from requests

Explanation

Preventing IDOR requires the server to verify that the authenticated user is authorized to access the requested object. Client-side validation and encoding are not security controls because attackers bypass them. Authorization must be enforced on the server for every object access.

Question 20Web Application Penetration Testing

During a test, a tester notices that the application responds differently to `GET /admin` with a 403 status when unauthenticated, but returns a 200 status when a forged `X-Original-URL: /admin` header is added. What does this indicate?

  1. A TLS configuration weakness
  2. A front-end access control bypass via header-based path override Correct answer.
  3. A weak password policy
  4. A reflected XSS vulnerability

Explanation

Some reverse proxies and frameworks honor headers like X-Original-URL to override the request path, which can bypass front-end access controls if the back end trusts the header. The tester should verify whether restricted paths become reachable. The fix is to strip such headers at the edge and enforce authorization consistently.

Question 21Web Application Penetration Testing

A tester suspects HTTP request smuggling between a front-end proxy and a back-end server. Which pair of conditions most commonly enables this vulnerability?

  1. Discrepancies in how the two servers interpret Content-Length and Transfer-Encoding headers Correct answer.
  2. Presence of the Strict-Transport-Security header
  3. Mismatched TLS versions between client and proxy
  4. Use of HTTP/2 on the front end only

Explanation

Request smuggling arises when front-end and back-end servers disagree on request boundaries, typically due to conflicting Content-Length and Transfer-Encoding handling. This allows an attacker to prepend requests that are processed by the back end. Consistent parsing and normalization are the primary mitigations.

Question 22Web Application Penetration Testing

A tester identifies a blind SSRF in an image-fetching feature. Which approach best demonstrates impact while remaining within scope?

  1. Pointing the fetcher at an out-of-band interaction server controlled by the tester Correct answer.
  2. Pointing the fetcher at the tester's production database
  3. Pointing the fetcher at a public search engine
  4. Pointing the fetcher at the target's login page

Explanation

Using an out-of-band interaction server confirms that the server makes attacker-directed requests without touching sensitive internal systems. This provides evidence of SSRF while respecting scope and safety. Internal service probing should only be done with explicit authorization.

Question 23Web Application Penetration Testing

A tester observes that an application uses a deserialization library to process a cookie value. Which indicator most strongly suggests a potential insecure deserialization vulnerability?

  1. The cookie is marked Secure and HttpOnly
  2. The cookie value is a random UUID
  3. The cookie contains a base64-encoded serialized object with class metadata Correct answer.
  4. The cookie has a short expiration time

Explanation

Serialized objects often contain recognizable class names, magic bytes, or structured metadata after decoding, indicating that the server deserializes client-controlled data. If untrusted input reaches a deserializer with dangerous gadget chains, code execution may follow. Random UUIDs or short lifetimes do not indicate this risk.

Question 24Web Application Penetration Testing

A tester finds that a web application uses a GraphQL endpoint with introspection enabled and no query depth limits. Which combination of risks is most relevant?

  1. Schema disclosure enabling targeted abuse and resource exhaustion via deeply nested queries Correct answer.
  2. Automatic encryption of query results and forced HTTPS
  3. Prevention of SQL injection through typed schemas
  4. Elimination of authorization flaws through field-level resolvers

Explanation

Introspection reveals the schema, helping attackers craft precise queries, while the absence of depth or complexity limits enables denial of service through expensive nested queries. Mitigations include disabling introspection in production and enforcing query cost analysis. Typed schemas do not inherently fix authorization or injection issues.

Question 25Web Application Penetration Testing

A tester observes that an application caches responses based on the full URL, including query strings, but does not vary on the `X-Forwarded-Host` header used to build absolute links. Which attack is most plausible?

  1. Cross-site request forgery against the cache server
  2. SQL injection through cached query parameters
  3. Session fixation through cache storage
  4. Web cache poisoning to serve malicious absolute links to other users Correct answer.

Explanation

If a response containing attacker-controlled host values is cached and served to other users, the attacker can poison the cache with malicious links. The server should include all relevant inputs in the cache key and avoid reflecting untrusted headers. This is a web cache poisoning scenario.

Question 26Web Application Penetration Testing

Which HTTP response header instructs the browser to enforce HTTPS for future connections to a site for a defined period?

  1. Strict-Transport-Security Correct answer.
  2. X-Frame-Options
  3. Referrer-Policy
  4. Content-Security-Policy

Explanation

HSTS is delivered via the Strict-Transport-Security header and tells the browser to refuse plaintext HTTP to the host for the max-age duration, mitigating SSL stripping. The other headers control resource loading, framing, and referrer leakage respectively.

Question 27Web Application Penetration Testing

A tester wants to check whether a login form is vulnerable to username enumeration. Which observation most directly supports that conclusion?

  1. The login page loads over HTTP instead of HTTPS
  2. The response body for an invalid username differs in wording from the response for a valid username with a wrong password Correct answer.
  3. The session cookie is set without the HttpOnly attribute
  4. The login form lacks a CAPTCHA challenge after several failed attempts

Explanation

Enumeration exists when the application produces distinguishable responses for existing versus non-existing accounts, such as different error text, status codes, or timing. CAPTCHA absence, cookie flags, and transport issues are separate weaknesses that do not by themselves reveal valid usernames.

Question 28Web Application Penetration Testing

Which HTTP method is defined as safe and idempotent and is therefore the conventional choice for retrieving a representation without side effects?

  1. GET Correct answer.
  2. PUT
  3. POST
  4. PATCH

Explanation

GET is defined by HTTP semantics as safe (no intended state change) and idempotent, so it is used for retrieval. POST is neither safe nor idempotent, while PUT and PATCH are idempotent but not safe because they modify state.

Question 29Web Application Penetration Testing

During reconnaissance, a tester wants to discover directories and files that are not linked from the application. Which approach is most appropriate?

  1. Reviewing the robots.txt disallow entries as the sole source of hidden paths
  2. Enumerating DNS records with a zone transfer attempt
  3. Sending requests for a wordlist of common paths and analysing status codes and response sizes Correct answer.
  4. Inspecting TLS certificate transparency logs for hostnames

Explanation

Content discovery relies on requesting candidate paths and comparing responses such as 200, 301, 401, or 403 and differing body lengths to identify hidden resources. Robots.txt may hint at paths but is not authoritative, and certificate or DNS enumeration reveals hostnames rather than paths on a single host.

Question 30Web Application Penetration Testing

A tester observes that the application sets a session cookie without the Secure attribute. What is the primary risk this introduces?

  1. The cookie will persist after the browser is closed
  2. The cookie may be transmitted over an unencrypted HTTP connection and intercepted Correct answer.
  3. The cookie will be shared across all subdomains of the site
  4. The cookie can be read by JavaScript in the page

Explanation

The Secure attribute restricts the cookie to HTTPS requests, so its absence allows the cookie to travel in cleartext where a network attacker could capture it. Script access is governed by HttpOnly, subdomain scope by the Domain attribute, and persistence by Expires or Max-Age.

Question 31Web Application Penetration Testing

Which encoding is most commonly used to represent binary data safely inside a URL query parameter or an HTTP Basic authentication credential?

  1. UTF-16 hexadecimal
  2. HTML entity encoding
  3. URL percent-encoding
  4. Base64 Correct answer.

Explanation

Base64 maps arbitrary binary data to a restricted ASCII alphabet, which is why Basic authentication credentials and many token formats use it. Percent-encoding is used for reserved characters in URLs, HTML entities for markup contexts, and UTF-16 hex is not a standard transport encoding.

Question 32Web Application Penetration Testing

A tester needs to map the parameters and endpoints an application exposes to its client-side JavaScript. Which source is most useful?

  1. The JavaScript bundles and source maps served to the browser Correct answer.
  2. The server's TLS cipher suite configuration
  3. The DNS TTL values for the application hostname
  4. The HTTP response header ordering

Explanation

Client-side JavaScript bundles, and especially source maps, often reveal API endpoints, parameter names, and hidden functionality. TLS configuration, DNS TTLs, and header ordering provide no information about application parameters.

Question 33Web Application Penetration Testing

Which vulnerability class arises when user input is concatenated into an operating system command executed by the server?

  1. OS command injection Correct answer.
  2. Insecure direct object reference
  3. Open redirect
  4. Cross-site scripting

Explanation

OS command injection occurs when untrusted input reaches a shell or process invocation without sanitisation, allowing metacharacters to append or alter commands. XSS executes in the browser, open redirect manipulates navigation, and IDOR concerns object-level authorisation.

Question 34Web Application Penetration Testing

A tester finds that an endpoint returns a 302 redirect to a URL supplied in the `next` parameter without validation. Which impact should the tester document?

  1. Disclosure of database contents through error messages
  2. Bypass of the SameSite cookie attribute
  3. Remote code execution on the web server
  4. Phishing leverage and possible theft of OAuth tokens through redirection to an attacker-controlled host Correct answer.

Explanation

An unvalidated redirect target lets an attacker craft trusted-looking links that lead to malicious sites and, in OAuth flows, can leak authorization codes or tokens to an attacker host. It does not by itself yield code execution or database disclosure.

Question 35Web Application Penetration Testing

A tester wants to verify whether an application is vulnerable to cross-site request forgery on a state-changing endpoint. Which combination of observations best supports the finding?

  1. The endpoint returns a CSRF token but the token is validated against the session
  2. The endpoint enforces the Origin header against an allowlist
  3. The endpoint accepts a simple form-encoded POST and relies only on the session cookie for authentication Correct answer.
  4. The endpoint requires a custom header that cannot be set cross-origin and rejects requests without it

Explanation

CSRF is possible when a state-changing request can be forged cross-site using ambient credentials and no unpredictable token or origin check is required. Custom headers, synchroniser tokens, and Origin validation each block the attack independently.

Question 36Web Application Penetration Testing

A tester is reviewing a file upload feature and wants to determine whether server-side validation can be bypassed. Which test is most directly aimed at that question?

  1. Uploading a file with non-ASCII characters in the filename
  2. Uploading a file with a very long filename
  3. Uploading a file with a valid image extension but a polyglot body containing script content Correct answer.
  4. Uploading a file larger than the configured size limit

Explanation

A polyglot file with an allowed extension but embedded active content tests whether validation relies only on the extension or Content-Type rather than content inspection. Size, filename length, and filename characters test different controls such as limits and encoding handling.

Question 37Web Application Penetration Testing

A tester observes that an application's `Set-Cookie` header includes the `Domain` attribute set to the registrable parent domain. What risk does this create?

  1. Any subdomain, including a compromised or attacker-registered one, can receive the cookie Correct answer.
  2. The cookie is automatically encrypted in transit
  3. The cookie is excluded from the browser's cookie jar
  4. The cookie becomes inaccessible to the server on subsequent requests

Explanation

Setting Domain to a parent domain scopes the cookie to all subdomains, so a subdomain takeover or an untrusted subdomain can read or set that cookie. This can enable session fixation or hijacking of the parent application.

Question 38Web Application Penetration Testing

A tester suspects a SQL injection in a numeric parameter. Which payload most reliably distinguishes a boolean-based injection from a simple syntax error?

  1. A single quote character
  2. A payload containing a null byte
  3. A payload that appends an arithmetic expression such as `AND 1=1` versus `AND 1=2` Correct answer.
  4. A payload containing an overlong UTF-8 sequence

Explanation

Comparing a true condition against a false condition shows whether the injected expression alters the query result, which is the basis of boolean-based detection. A lone quote usually only provokes an error, null bytes test truncation, and overlong sequences test encoding handling.

Question 39Web Application Penetration Testing

An application reflects a user-supplied value inside a JavaScript string literal in an inline `<script>` block. Which encoding is appropriate to prevent script breakout in that context?

  1. Base64 encoding of the entire page
  2. JavaScript string escaping with correct quote handling Correct answer.
  3. URL percent-encoding
  4. HTML entity encoding

Explanation

Context matters: data placed inside a JavaScript string must be escaped for JavaScript, including handling of quotes, backslashes, and line terminators. HTML entity encoding suits HTML text, percent-encoding suits URL components, and whole-page Base64 is not an output-encoding strategy.

Question 40Web Application Penetration Testing

A tester finds that an application exposes an admin function through a hidden button in the UI, and the server accepts the request when sent directly by a low-privileged user. Which weakness does this represent?

  1. Client-side security control relying on UI hiding without server-side authorisation Correct answer.
  2. Cross-site scripting
  3. Weak transport security
  4. Insecure deserialization

Explanation

Hiding functionality in the interface is not an access control; if the server does not enforce authorisation, any user who learns the request can invoke it. This is a broken function-level authorisation issue rather than deserialization, XSS, or transport weakness.

Question 41Web Application Penetration Testing

A tester discovers that an application uses a predictable pattern for password reset tokens based on the user's email and a timestamp. Which attack is most feasible?

  1. Intercepting the token through a TLS downgrade
  2. Triggering a buffer overflow in the reset handler
  3. Brute-forcing the token by generating candidate values within the validity window Correct answer.
  4. Extracting the token from the server's memory

Explanation

Predictable tokens with low entropy can be recomputed from known inputs such as the email and approximate time, so an attacker can generate candidates and test them before expiry. TLS downgrade, memory extraction, and buffer overflows are unrelated to token predictability.

Question 42Web Application Penetration Testing

Which HTTP status code most directly indicates that authentication is required and that the client should supply credentials?

  1. 500 Internal Server Error
  2. 403 Forbidden
  3. 401 Unauthorized Correct answer.
  4. 404 Not Found

Explanation

401 signals missing or invalid authentication and typically includes a WWW-Authenticate challenge. 403 means the identity is known but not permitted, 404 means the resource is absent, and 500 indicates a server error.

Question 43Web Application Penetration Testing

A tester observes that an application's error handling returns a generic message to the client but logs detailed exceptions server-side. How should this affect the assessment?

  1. It proves the application is free of injection flaws
  2. It means the tester should stop testing error handling entirely
  3. It reduces information disclosure but does not remove the underlying vulnerabilities, which must still be tested through blind techniques Correct answer.
  4. It eliminates the need to test injection because no errors are reflected

Explanation

Generic client errors reduce leakage but do not fix vulnerabilities; blind and boolean-based techniques remain necessary to detect them. Absence of reflected errors is not evidence of absence of injection, and server-side logging is a good practice rather than a proof of security.

Question 44Web Application Penetration Testing

A tester is assessing a SOAP service and wants to determine whether XML external entity processing is enabled. Which observation best confirms successful entity expansion?

  1. The response includes content from a local file referenced by a defined external entity Correct answer.
  2. The server returns a fault with a generic message
  3. The server rejects requests without a SOAPAction header
  4. The server returns a 400 status for malformed XML

Explanation

Successful XXE is confirmed when an externally defined entity is resolved and its content, such as a local file, appears in the response or is otherwise exfiltrated. A 400 for malformed XML, missing headers, and generic faults do not demonstrate entity resolution.

Question 45Web Application Penetration Testing

A tester finds that a server accepts a request with both `Transfer-Encoding: chunked` and a `Content-Length` header and the front-end and back-end disagree on which to honour. Which class of attack does this enable?

  1. HTTP request smuggling Correct answer.
  2. Server-side request forgery
  3. Cross-site scripting through reflected headers
  4. Insecure deserialization

Explanation

Disagreement over message framing between intermediaries allows an attacker to smuggle a request that the back-end processes as a separate message, poisoning the connection. Reflected XSS, SSRF, and deserialization involve different mechanisms entirely.

Question 46Web Application Penetration Testing

A tester wants to determine whether a web cache is vulnerable to deception. Which condition is necessary for cache deception to succeed?

  1. The application must use HTTP/2 exclusively
  2. The cache must be configured to bypass all static extensions
  3. The cache must store responses for URLs that the application treats as authenticated dynamic content Correct answer.
  4. The server must set the `Vary: User-Agent` header

Explanation

Cache deception tricks a cache into storing a victim's authenticated response under a URL the attacker can later retrieve, which requires the cache to key on a path the application still routes to dynamic content. Protocol version, Vary headers, and extension bypass rules do not by themselves create the flaw.

Question 47Web Application Penetration Testing

A tester observes that a GraphQL mutation accepts a nested input object and the server resolves fields recursively without depth limits. Which risk is most directly associated with this design?

  1. Bypass of TLS certificate validation
  2. Automatic exposure of the GraphQL schema to unauthenticated users
  3. Disclosure of server environment variables through error messages
  4. Query depth amplification leading to resource exhaustion Correct answer.

Explanation

Deeply nested or recursive queries and mutations can consume disproportionate server resources, enabling denial of service. Schema exposure relates to introspection settings, certificate validation is a client concern, and environment leakage is an error-handling issue.

Question 48Web Application Penetration Testing

A tester identifies a server-side request forgery in a PDF-generation feature that fetches remote images. Which validation approach is most effective at reducing SSRF risk while preserving functionality?

  1. Requiring the user to confirm the URL in the browser
  2. Blocking requests to private and link-local IP ranges after DNS resolution and enforcing an allowlist of permitted hosts Correct answer.
  3. Disabling HTTPS on the fetch feature
  4. Filtering the request string for the literal text `localhost`

Explanation

Robust SSRF defence resolves the hostname and validates the resulting address against private, loopback, and link-local ranges, ideally combined with an allowlist of destinations. String blocklists are bypassable through alternate representations and DNS rebinding, and disabling HTTPS or client confirmation does not prevent server-side fetches.

Question 49Web Application Penetration Testing

A tester finds a deserialization endpoint that accepts a signed but user-controlled object in a cookie. Which factor most increases the likelihood of remote code execution?

  1. The absence of the HttpOnly attribute on the cookie
  2. The presence of gadget chains in libraries on the classpath that execute during deserialization Correct answer.
  3. The use of a 200 status code for successful responses
  4. The use of JSON rather than XML for the request body

Explanation

Deserialization RCE requires classes whose magic methods perform dangerous actions when invoked during object reconstruction, known as gadget chains. The body format, cookie flags, and status codes do not supply the code paths needed to achieve execution.

Question 50Web Application Penetration Testing

A tester is assessing an application behind a reverse proxy that rewrites headers. Which technique best determines the client IP as seen by the back-end when testing IP-based access controls?

  1. Sending `X-Forwarded-For`, `X-Real-IP`, and `Forwarded` headers with distinct values and observing which value the application trusts Correct answer.
  2. Using only IPv6 source addresses
  3. Disabling cookies in the client
  4. Sending requests without any headers and relying on the default

Explanation

Applications behind proxies often trust forwarded headers for client IP, so supplying distinct values across the common header names reveals which one is honoured and whether spoofing bypasses IP restrictions. Removing headers, changing address family, or disabling cookies does not test header trust.