I85PREP
⌘ K
eWPTX study materials
eWPTX study resources

eWPTX practice questions

One question at a time. Build your eWPTX understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Advanced Web Application Penetration Testing

During a web application assessment, a tester wants to determine whether the server processes URL-encoded input differently from raw input. Which technique best reveals a decoding discrepancy?

  1. Repeating the identical request several times to check for rate limiting
  2. Submitting the same payload in raw, single-encoded, and double-encoded forms and comparing responses Correct answer.
  3. Sending the payload only through an intercepting proxy with TLS disabled
  4. Replacing the payload with a very long string to trigger a stack trace

Explanation

Decoding discrepancies appear when different layers normalize input differently, so comparing raw, single-encoded, and double-encoded variants of the same payload exposes where decoding happens. Varying only the transport or repeating requests does not test normalization behavior.

Question 2Advanced Web Application Penetration Testing

Which HTTP mechanism is specifically designed to let a browser send credentialed cross-origin requests while giving the server control over which origins are allowed?

  1. Cross-Origin Resource Sharing Correct answer.
  2. HTTP Strict Transport Security
  3. Content-Security-Policy
  4. Subresource Integrity

Explanation

CORS defines headers such as Access-Control-Allow-Origin and Access-Control-Allow-Credentials that govern cross-origin credentialed requests. The other headers address content injection, resource tampering, and transport downgrade respectively.

Question 3Advanced Web Application Penetration Testing

A tester observes that an application sets session cookies without the HttpOnly attribute. What is the most direct security consequence?

  1. The cookie expires when the browser closes.
  2. The cookie can be read by client-side JavaScript. Correct answer.
  3. The cookie is shared across all subdomains.
  4. The cookie is transmitted only over HTTPS.

Explanation

HttpOnly prevents scripts from accessing the cookie via document.cookie, so its absence exposes the value to script-based theft. The other attributes (Secure, Domain, expiry) control transport, scope, and lifetime, not script access.

Question 4Advanced Web Application Penetration Testing

Which HTTP response header primarily instructs the browser to restrict which origins may frame the page, mitigating clickjacking?

  1. Permissions-Policy
  2. X-Content-Type-Options
  3. Content-Security-Policy frame-ancestors Correct answer.
  4. Referrer-Policy

Explanation

The frame-ancestors directive in CSP controls which origins may embed the page in a frame, directly countering clickjacking. The other headers address MIME sniffing, referrer leakage, and feature access.

Question 5Advanced Web Application Penetration Testing

An application reflects user input inside an HTML attribute value delimited by double quotes. Which encoding is most appropriate to neutralize injection there?

  1. Base64 encoding of the input
  2. URL encoding of the entire value
  3. JavaScript hex escaping
  4. HTML entity encoding of quotes and angle brackets Correct answer.

Explanation

Within a quoted HTML attribute, HTML entity encoding of characters such as quotes and angle brackets prevents breaking out of the attribute context. URL, Base64, and JS escaping do not match the HTML attribute parsing context.

Question 6Advanced Web Application Penetration Testing

Which practice best protects a session identifier against fixation attacks?

  1. Setting a long cookie expiry to reduce re-authentication
  2. Issuing a new session identifier upon successful authentication Correct answer.
  3. Storing the identifier in a URL query parameter
  4. Encrypting the cookie value with a static key

Explanation

Session fixation is mitigated by rotating the session identifier at authentication so a pre-set identifier becomes invalid. Encryption, URL storage, and long expiry do not prevent an attacker from planting a known identifier.

Question 7Advanced Web Application Penetration Testing

A tester wants to enumerate hidden parameters accepted by an API endpoint that the UI does not expose. Which approach is most appropriate?

  1. Removing all request headers
  2. Changing the HTTP method to TRACE
  3. Sending the request with an empty body repeatedly
  4. Fuzzing parameter names derived from documentation, JavaScript, and common wordlists Correct answer.

Explanation

Hidden parameters are discovered by systematically testing candidate names from documentation, client code, and wordlists, then observing response differences. The other approaches do not generate candidate parameter names.

Question 8Advanced Web Application Penetration Testing

Which vulnerability class arises when an application trusts a client-supplied value to determine the file path it reads or writes?

  1. Path traversal Correct answer.
  2. Insecure deserialization
  3. Server-side request forgery
  4. Cross-site scripting

Explanation

Path traversal occurs when user-controlled input is used to build filesystem paths without proper validation, allowing access outside intended directories. The other classes involve server-side requests, script injection, or object deserialization.

Question 9Advanced Web Application Penetration Testing

A tester submits a payload that causes the server to fetch an internal metadata URL and return its contents in the response. Which vulnerability is demonstrated?

  1. Server-side request forgery Correct answer.
  2. Open redirect
  3. XML external entity injection
  4. Cross-site request forgery

Explanation

SSRF occurs when the server makes requests to attacker-chosen destinations, here reaching internal metadata endpoints. The other classes involve forged browser requests, redirects, or XML entity expansion.

Question 10Advanced Web Application Penetration Testing

An application uses a JWT signed with the HS256 algorithm and the server accepts the alg header from the token. Which attack should a tester attempt first?

  1. Brute-forcing the RSA private key
  2. Injecting a SQL payload into the payload claim
  3. Changing alg to none and removing the signature Correct answer.
  4. Replaying the token after changing only the typ header

Explanation

When the algorithm is taken from the token, a tester checks whether an unsigned token with alg set to none is accepted. HS256 uses a shared secret, so there is no RSA private key to brute-force, and payload manipulation still requires valid signing.

Question 11Advanced Web Application Penetration Testing

A blind SQL injection point returns different response times depending on the truth of an injected condition. Which technique is being used?

  1. Error-based extraction
  2. Time-based blind extraction Correct answer.
  3. Out-of-band extraction
  4. Union-based extraction

Explanation

Time-based blind injection infers data by measuring delays triggered by conditional statements. Error-based relies on error messages, union-based on appended result sets, and out-of-band on external channels.

Question 12Advanced Web Application Penetration Testing

An application reflects input into a JavaScript string literal inside a script block. Which approach best prevents breaking out of the string context?

  1. HTML entity encoding
  2. URL encoding
  3. Unicode escaping of quotes and backslashes for the JS context Correct answer.
  4. Base64 encoding

Explanation

In a JavaScript string context, escaping quotes and backslashes with context-appropriate JavaScript encoding prevents termination of the string. HTML, URL, and Base64 encodings do not match the JavaScript parsing context.

Question 13Advanced Web Application Penetration Testing

A tester finds that a web application accepts XML input and returns the contents of a local file when an external entity is declared. Which mitigation most directly addresses this?

  1. Adding a Content-Security-Policy header
  2. Enabling HTTP Strict Transport Security
  3. Setting the Secure cookie flag
  4. Disabling external entity resolution in the XML parser Correct answer.

Explanation

XXE is mitigated by disabling external entity and DTD processing in the parser. The other controls address script sources, transport security, and cookie transport, not XML entity resolution.

Question 14Advanced Web Application Penetration Testing

An application allows users to upload files that are later served from the same origin. Which control most directly reduces the risk of stored script execution?

  1. Increasing the maximum upload size
  2. Serving uploaded files with a Content-Disposition attachment header and a restrictive content type Correct answer.
  3. Renaming uploaded files with random identifiers
  4. Compressing uploaded files into archives

Explanation

Forcing download disposition and a non-executable content type prevents the browser from rendering uploaded content as active script in the origin. Renaming, size limits, and compression do not change how the browser interprets the file.

Question 15Advanced Web Application Penetration Testing

A tester observes that a web cache stores responses keyed only on the URL path, ignoring a header that alters response content. Which attack is enabled?

  1. Web cache deception
  2. Cache poisoning via unkeyed headers Correct answer.
  3. Session fixation
  4. HTTP request smuggling

Explanation

When a response varies on an input that is not part of the cache key, an attacker can poison the cached response for other users. Cache deception concerns tricking a cache into storing private content, not unkeyed header variation.

Question 16Advanced Web Application Penetration Testing

Which condition must typically hold for a cross-site request forgery attack against a state-changing endpoint to succeed?

  1. The attacker must know the victim's password
  2. The endpoint must reflect user input in the response
  3. The request must be authenticated by the victim's browser and rely on ambient credentials Correct answer.
  4. The victim must have JavaScript enabled

Explanation

CSRF succeeds when the browser automatically attaches the victim's credentials to a forged request and the server cannot distinguish it from a legitimate one. Knowledge of the password, reflection, and JavaScript are not required.

Question 17Advanced Web Application Penetration Testing

A tester identifies an endpoint that returns different responses for existing and non-existing usernames during login. Which weakness is present?

  1. Insecure direct object reference
  2. Username enumeration Correct answer.
  3. Privilege escalation
  4. Race condition

Explanation

Differential responses reveal whether an account exists, enabling username enumeration. Privilege escalation, IDOR, and race conditions involve authorization, object access, and timing concurrency respectively.

Question 18Advanced Web Application Penetration Testing

An application exposes an administrative function that checks authorization only in the client-side interface. Which control should the tester verify is implemented server-side?

  1. Content-Security-Policy on the admin page
  2. Cookie SameSite attribute
  3. Function-level authorization checks on each request Correct answer.
  4. Subresource Integrity on scripts

Explanation

Access control must be enforced server-side per request; hiding UI elements is not a security control. CSP, SameSite, and SRI address browser-side protections, not authorization.

Question 19Advanced Web Application Penetration Testing

A tester observes that a server responds to malformed request framing differently than the front-end proxy does. Which vulnerability class does this most directly suggest?

  1. Open redirect
  2. Insecure deserialization
  3. HTTP request smuggling Correct answer.
  4. Cross-site scripting

Explanation

Discrepancies in how front-end and back-end parse request boundaries can allow smuggling of a hidden request. The other classes involve script injection, redirects, or object deserialization.

Question 20Advanced Web Application Penetration Testing

A tester wants to test for server-side template injection in a parameter reflected into a rendered template. Which payload best confirms template evaluation rather than plain reflection?

  1. An arithmetic expression using template syntax that evaluates to a result Correct answer.
  2. An HTML tag that renders bold text
  3. A URL-encoded newline character
  4. A very long string of random characters

Explanation

Template injection is confirmed when template syntax is evaluated and the computed result appears in the output. Long strings, HTML tags, and control characters test length, rendering, and parsing, not evaluation.

Question 21Advanced Web Application Penetration Testing

An application uses a deserialization library that instantiates classes named in user-supplied data. Which risk is most significant?

  1. Clickjacking
  2. Directory listing
  3. Cross-site request forgery
  4. Remote code execution through gadget chains Correct answer.

Explanation

Untrusted deserialization can trigger gadget chains that execute code during object reconstruction. CSRF, clickjacking, and directory listing do not arise from object instantiation.

Question 22Advanced Web Application Penetration Testing

A tester finds that an application's password reset token is derived from a predictable timestamp and username. Which weakness is most directly present?

  1. Insufficient token entropy enabling prediction Correct answer.
  2. Missing HttpOnly flag on the token cookie
  3. Lack of transport encryption
  4. Absence of rate limiting on login

Explanation

Tokens derived from predictable inputs have low entropy, allowing an attacker to compute valid reset tokens. Cookie flags, transport, and login rate limiting address different controls.

Question 23Advanced Web Application Penetration Testing

During testing, a race condition in a coupon redemption endpoint allows the same coupon to be applied multiple times when requests are sent concurrently. Which technique best demonstrates this reliably?

  1. Sending many requests simultaneously and comparing the resulting balance Correct answer.
  2. Sending requests sequentially with delays
  3. Changing the HTTP method of a single request
  4. Replaying a single request after logout

Explanation

Race conditions require concurrent execution to exploit the window between check and use, so synchronized parallel requests best demonstrate the flaw. Sequential or single requests do not exercise the timing window.

Question 24Advanced Web Application Penetration Testing

A tester observes that a JWT signed with RS256 is accepted after being re-signed with HS256 using the server's public key as the secret. Which weakness is exploited?

  1. Weak password hashing on the login form
  2. Missing token expiration
  3. Insecure token storage in localStorage
  4. Algorithm confusion between asymmetric and symmetric verification Correct answer.

Explanation

Algorithm confusion occurs when the verifier accepts a symmetric algorithm using the public key as the shared secret, allowing forgery. Hashing, expiration, and storage relate to other controls.

Question 25Advanced Web Application Penetration Testing

A tester discovers that an endpoint accepts a URL parameter and uses it to build a server-side request, but only internal hosts respond. Which technique best confirms the SSRF beyond a simple external callback?

  1. Changing the request method to HEAD
  2. Sending an invalid URL to observe error handling
  3. Adding a long query string to the parameter
  4. Requesting internal metadata endpoints and comparing responses Correct answer.

Explanation

Confirming SSRF against internal services requires targeting internal addresses such as metadata endpoints and observing differentiated responses. Invalid URLs, long strings, and method changes do not prove internal reachability.

Question 26Advanced Web Application Penetration Testing

Which HTTP response header instructs the browser to enforce a restrictive Content Security Policy and report violations without blocking content?

  1. X-Content-Type-Options
  2. Content-Security-Policy-Report-Only Correct answer.
  3. Strict-Transport-Security
  4. Referrer-Policy

Explanation

The Content-Security-Policy-Report-Only header allows a policy to be tested by sending violation reports to a specified URI without actually blocking any content. This is useful for tuning a CSP before enforcement. The other headers serve different security purposes and do not control script execution.

Question 27Advanced Web Application Penetration Testing

Which SQL injection technique is most appropriate when the application returns no data and no error messages but the tester can observe timing differences?

  1. Out-of-band injection
  2. Blind time-based injection Correct answer.
  3. Union-based injection
  4. Error-based injection

Explanation

Blind time-based injection infers data by measuring delays caused by conditional statements, making it suitable when no output or errors are visible. Union and error-based techniques require visible output or error messages. Out-of-band requires an external channel, which may not be available.

Question 28Advanced Web Application Penetration Testing

Which of the following is a primary defense against cross-site scripting (XSS) vulnerabilities?

  1. Using HTTPS
  2. Input validation
  3. Output encoding Correct answer.
  4. Implementing CAPTCHA

Explanation

Output encoding ensures that user-supplied data is treated as text rather than executable code when rendered in the browser, neutralizing XSS payloads. Input validation can help but is not sufficient alone because context matters. HTTPS and CAPTCHA do not prevent script injection.

Question 29Advanced Web Application Penetration Testing

When testing for directory traversal, which encoding is commonly used to bypass basic input filters that block the '../' sequence?

  1. Base64 encoding
  2. URL encoding Correct answer.
  3. HTML entity encoding
  4. Unicode normalization

Explanation

URL encoding (percent-encoding) represents characters like '.' and '/' as %2e and %2f, which may bypass filters that only look for literal '../'. Base64 and HTML entity encoding are not typically used in path traversal because the application would not decode them as path separators. Unicode normalization can sometimes be used but is less common for this specific bypass.

Question 30Advanced Web Application Penetration Testing

Which tool is primarily used for intercepting and modifying HTTP traffic between a browser and a web server during a penetration test?

  1. Nmap
  2. Metasploit
  3. Wireshark
  4. Burp Suite Correct answer.

Explanation

Burp Suite is an intercepting proxy designed to capture, inspect, and modify HTTP/HTTPS traffic, making it a core tool for web application testing. Nmap is for network scanning, Metasploit is for exploitation, and Wireshark is for packet analysis, not HTTP interception.

Question 31Advanced Web Application Penetration Testing

What is the primary security risk of using predictable session identifiers?

  1. SQL injection
  2. Session fixation
  3. Cross-site scripting
  4. Session hijacking Correct answer.

Explanation

Predictable session identifiers allow an attacker to guess valid session IDs and hijack active sessions. Session fixation involves forcing a known session ID on a user, which is different. XSS and SQL injection are separate vulnerability classes.

Question 32Advanced Web Application Penetration Testing

Which HTTP method is considered idempotent and should not change server state when properly implemented?

  1. PUT
  2. GET Correct answer.
  3. POST
  4. PATCH

Explanation

The GET method is defined as safe and idempotent, meaning it should only retrieve data and not alter server state. POST, PUT, and PATCH are intended to modify resources, although PUT is idempotent, it is not safe.

Question 33Advanced Web Application Penetration Testing

Which of the following is a common indicator of a potential SQL injection vulnerability during manual testing?

  1. The application implements rate limiting.
  2. The application sets the HttpOnly flag on cookies.
  3. The application uses HTTPS.
  4. The application returns a 500 error when a single quote is submitted. Correct answer.

Explanation

Submitting a single quote often breaks SQL syntax and causes a database error, which may be reflected as a 500 error, indicating improper input handling. HTTPS, HttpOnly cookies, and rate limiting are security measures unrelated to SQL injection detection.

Question 34Advanced Web Application Penetration Testing

During testing, you find that an application uses client-side validation for file uploads. Which technique best bypasses this to upload a malicious file?

  1. Disable JavaScript in the browser
  2. Intercept and modify the HTTP request Correct answer.
  3. Use a different browser
  4. Change the file extension

Explanation

Client-side validation can be bypassed by intercepting the HTTP request with a proxy and modifying the file content or metadata before it reaches the server. Disabling JavaScript may prevent validation but does not guarantee the upload will succeed if server-side checks exist. Changing the browser or extension alone may not bypass server-side controls.

Question 35Advanced Web Application Penetration Testing

Which of the following best describes a second-order SQL injection attack?

  1. The malicious input is stored and later executed when retrieved by another part of the application. Correct answer.
  2. The attack requires two simultaneous connections to the database.
  3. The malicious input is executed immediately upon submission.
  4. The attack uses two different injection points in the same query.

Explanation

Second-order SQL injection occurs when user input is stored in the database and later used in a SQL query without proper sanitization, often in a different context. Immediate execution is first-order. Simultaneous connections or multiple injection points are not defining characteristics.

Question 36Advanced Web Application Penetration Testing

When testing for XML External Entity (XXE) injection, which payload is commonly used to read the /etc/passwd file?

  1. <!ENTITY xxe SYSTEM "file:///etc/passwd"> Correct answer.
  2. <!ENTITY xxe SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">
  3. <!ENTITY xxe PUBLIC "file:///etc/passwd">
  4. <!ENTITY xxe SYSTEM "http://attacker.com/xxe">

Explanation

The SYSTEM identifier with a file:// URI is the standard way to reference a local file in an XXE payload. The http:// URI would cause an out-of-band request, not read a local file. PUBLIC is used for DTDs, and php://filter is a PHP-specific wrapper not universally applicable.

Question 37Advanced Web Application Penetration Testing

Which of the following is a key characteristic of a Server-Side Request Forgery (SSRF) vulnerability?

  1. The attacker can read files from the server's file system.
  2. The attacker can execute arbitrary code on the server.
  3. The attacker can make the server send requests to internal resources. Correct answer.
  4. The attacker can inject SQL commands into the database.

Explanation

SSRF allows an attacker to induce the server to make HTTP requests to arbitrary destinations, often targeting internal services. Code execution, file read, and SQL injection are different vulnerability classes.

Question 38Advanced Web Application Penetration Testing

When testing for insecure deserialization in a Java application, which magic method is commonly invoked during deserialization?

  1. __wakeup
  2. __construct
  3. readObject Correct answer.
  4. finalize

Explanation

In Java, the readObject method is called during deserialization and can be overridden to execute arbitrary code. __construct and __wakeup are PHP magic methods. finalize is called by the garbage collector, not during deserialization.

Question 39Advanced Web Application Penetration Testing

Which technique is most effective for exploiting a blind SQL injection vulnerability where the application returns no output and no errors?

  1. Boolean-based blind injection
  2. Union-based injection
  3. Error-based injection
  4. Time-based blind injection Correct answer.

Explanation

Time-based blind injection uses conditional delays to infer data, which works even when no output or errors are returned. Boolean-based blind injection requires a difference in response content, which may not be present. Error-based and union-based require visible errors or output.

Question 40Advanced Web Application Penetration Testing

Which of the following is a common bypass technique for a web application firewall (WAF) that blocks SQL injection keywords?

  1. Using a different user agent
  2. Adding extra whitespace
  3. Switching to HTTPS
  4. Using inline comments to obfuscate keywords Correct answer.

Explanation

Inline comments (e.g., /*!SELECT*/) can break up keywords to evade signature-based WAF rules. Switching to HTTPS, changing user agent, or adding whitespace may not reliably bypass keyword filters.

Question 41Advanced Web Application Penetration Testing

When testing for cross-site request forgery (CSRF), which condition must be present for an attack to be successful?

  1. The application sets the SameSite attribute on cookies.
  2. The application implements CAPTCHA.
  3. The application uses session cookies for authentication. Correct answer.
  4. The application uses HTTPS.

Explanation

CSRF attacks rely on the browser automatically including credentials such as session cookies with requests. If the application does not use cookies for authentication, CSRF may not be possible. HTTPS, CAPTCHA, and SameSite cookies are defenses against CSRF.

Question 42Advanced Web Application Penetration Testing

Which of the following is a primary security concern with JSON Web Tokens (JWT) when the 'none' algorithm is accepted?

  1. Token expiration
  2. Token interception
  3. Token replay
  4. Token forgery Correct answer.

Explanation

If the server accepts unsigned tokens with the 'none' algorithm, an attacker can forge tokens with arbitrary claims. Replay attacks involve reusing valid tokens, interception requires network access, and expiration is a token property, not a vulnerability.

Question 43Advanced Web Application Penetration Testing

In an application that uses graph databases, which injection technique is analogous to SQL injection?

  1. NoSQL injection
  2. Cypher injection Correct answer.
  3. XPath injection
  4. LDAP injection

Explanation

Cypher is the query language for Neo4j and other graph databases, so injection into Cypher queries is the graph database equivalent. NoSQL injection targets document stores like MongoDB, LDAP injection targets directory services, and XPath injection targets XML.

Question 44Advanced Web Application Penetration Testing

Which of the following is a common method to bypass a file upload restriction that checks only the Content-Type header?

  1. Changing the Content-Type header to image/jpeg Correct answer.
  2. Uploading a file with a double extension
  3. Renaming the file to have a .jpg extension
  4. Using a polyglot file

Explanation

If the server only checks the Content-Type header, modifying it to an allowed type (e.g., image/jpeg) can bypass the restriction. Renaming the file or using a polyglot may not bypass header checks, and double extensions target different validation weaknesses.

Question 45Advanced Web Application Penetration Testing

When testing for race conditions in a web application, which technique is most effective for exploiting a time-of-check to time-of-use (TOCTOU) flaw?

  1. Using a different HTTP method
  2. Sending requests with different session cookies
  3. Using a slow network connection
  4. Sending multiple simultaneous requests Correct answer.

Explanation

Race conditions often require sending multiple requests concurrently to exploit the window between check and use. A slow connection or different cookies do not directly target the timing issue. Changing the HTTP method does not address the race condition.

Question 46Advanced Web Application Penetration Testing

Which of the following best describes the risk of using a weak cryptographic hash function like MD5 for password storage?

  1. It is not vulnerable to rainbow table attacks.
  2. It provides insufficient entropy for salting.
  3. It is vulnerable to collision attacks that can reveal passwords.
  4. It allows for efficient brute-force attacks due to fast computation. Correct answer.

Explanation

MD5 is fast to compute, enabling attackers to perform brute-force or dictionary attacks quickly. Collision attacks are a concern for integrity but not directly for password recovery. Rainbow tables can be mitigated with salting, and entropy is related to the salt, not the hash function.

Question 47Advanced Web Application Penetration Testing

During a penetration test, you discover that an application uses a JWT signed with RS256 and the server accepts tokens signed with HS256 using the public key as the HMAC secret. Which attack is this?

  1. Signature stripping attack
  2. Key injection attack
  3. None algorithm attack
  4. Algorithm confusion attack Correct answer.

Explanation

An algorithm confusion attack occurs when the server accepts a token signed with a different algorithm than expected, such as using the public key as an HMAC secret for HS256. The none algorithm attack involves unsigned tokens, key injection involves injecting a key, and signature stripping removes the signature.

Question 48Advanced Web Application Penetration Testing

When testing a GraphQL endpoint, which technique is used to discover hidden fields and types?

  1. Introspection query Correct answer.
  2. Cross-site scripting
  3. SQL injection
  4. Directory traversal

Explanation

GraphQL introspection allows querying the schema to discover types, fields, and mutations. SQL injection, XSS, and directory traversal are unrelated to GraphQL schema discovery.

Question 49Advanced Web Application Penetration Testing

Which of the following is a sophisticated technique to exploit a blind SSRF vulnerability where the response is not returned to the attacker?

  1. Sending a payload that causes the server to make a request to an attacker-controlled server
  2. Injecting SQL commands to read the response
  3. Using DNS rebinding to bypass network restrictions Correct answer.
  4. Using a timing side-channel to infer internal network structure

Explanation

DNS rebinding can bypass SSRF protections by resolving a domain to an internal IP after initial validation, allowing access to internal resources. Timing side-channels can infer some information but are less reliable. Out-of-band requests are useful but do not directly exploit blind SSRF for internal access. SQL injection is unrelated.

Question 50Advanced Web Application Penetration Testing

In an application using PHP's unserialize() on user-supplied data, which magic method is called when an object is serialized?

  1. __destruct
  2. __toString
  3. __sleep Correct answer.
  4. __wakeup

Explanation

The __sleep method is called when an object is serialized, allowing the object to specify which properties should be serialized. __wakeup is called during unserialization. __destruct is called when the object is destroyed, and __toString when the object is treated as a string.