I85PREP
⌘ K
HTB CWES study materials
HTB CWES study resources

HTB CWES practice questions

One question at a time. Build your HTB CWES understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web Application Reconnaissance and Enumeration

During web reconnaissance, which record type is queried to discover the mail servers associated with a target domain?

  1. TXT
  2. SRV
  3. MX Correct answer.
  4. CNAME

Explanation

MX (Mail Exchanger) records publish the hostnames of the systems that accept email for a domain, so they reveal mail infrastructure and often third-party providers. Enumerating them helps map the target's external footprint beyond just web hosts.

Question 2Web Application Reconnaissance and Enumeration

Which HTTP response header most directly reveals the software and version powering the web server?

  1. Content-Type
  2. Accept-Ranges
  3. Server Correct answer.
  4. Vary

Explanation

The Server header frequently discloses the web server product and version, which lets a tester look up known vulnerabilities for that build. Content-Type, Accept-Ranges, and Vary describe content negotiation and caching behavior, not the server software.

Question 3Web Application Reconnaissance and Enumeration

A tester wants to find directories and files that are not linked from a site but still exist on the server. Which technique is designed for this?

  1. TCP SYN scanning of all ports
  2. TLS certificate transparency log review
  3. Content discovery using a wordlist Correct answer.
  4. Passive DNS resolution

Explanation

Content discovery brute-forces or guesses paths from a wordlist and checks the server's responses to find unlinked resources. Passive DNS, port scanning, and certificate transparency reveal hosts and services but do not enumerate paths on a given web server.

Question 4Web Application Reconnaissance and Enumeration

Which tool is commonly used to fingerprint the technologies a web application is built with, such as frameworks and CMS platforms?

  1. Gobuster
  2. Nmap
  3. Wappalyzer Correct answer.
  4. Dig

Explanation

Wappalyzer inspects page content, headers, and scripts to infer the frameworks, CMS, and libraries in use. Nmap maps network services, Dig queries DNS, and Gobuster performs content discovery, so none of them specialize in technology fingerprinting.

Question 5Web Application Reconnaissance and Enumeration

When enumerating subdomains, what is the primary purpose of a DNS zone transfer attempt?

  1. To intercept encrypted DNS traffic between clients
  2. To poison the resolver cache with forged answers
  3. To obtain the full list of records if the server is misconfigured to allow it Correct answer.
  4. To brute-force administrator credentials on the DNS server

Explanation

An AXFR zone transfer, if permitted, returns every record in the zone, exposing subdomains and internal hosts in one query. It is a misconfiguration because authoritative servers should restrict transfers to trusted secondaries.

Question 6Web Application Reconnaissance and Enumeration

Which file, when publicly accessible, is often used during reconnaissance to reveal paths the site owner intended to keep out of search engines?

  1. sitemap.xml
  2. favicon.ico
  3. robots.txt Correct answer.
  4. crossdomain.xml

Explanation

robots.txt lists paths that crawlers should avoid, which frequently includes administrative or sensitive directories of interest to a tester. Sitemap.xml advertises intended public pages, while favicon and crossdomain files serve other purposes.

Question 7Web Application Reconnaissance and Enumeration

A tester sends a request for a nonexistent path and receives a 200 OK with a generic page for every random string. What does this indicate about content discovery?

  1. The wordlist is too small to find real paths
  2. The site has disabled HTTP status codes entirely
  3. The server uses a catch-all response, so status codes alone are unreliable and response length or content must be compared Correct answer.
  4. The server is vulnerable to directory traversal

Explanation

A catch-all or soft-404 behavior returns 200 for unknown paths, so a simple status-code filter produces false positives. Testers must instead compare response size, body content, or similarity to a baseline random-path response.

Question 8Web Application Reconnaissance and Enumeration

During enumeration you observe that responses to valid users differ in length from responses to invalid users on a login endpoint. Which reconnaissance finding does this represent?

  1. A user enumeration vector through response differences Correct answer.
  2. An insecure direct object reference
  3. A cross-site scripting vulnerability
  4. A DNS rebinding opportunity

Explanation

Differing response sizes, timing, or messages for valid versus invalid accounts let an attacker confirm which usernames exist. This is a user enumeration vector that should be noted and later tested for exploitation.

Question 9Web Application Reconnaissance and Enumeration

Which approach best combines passive and active subdomain enumeration to maximize coverage?

  1. Only inspect the homepage HTML for links
  2. Only scan the primary IP for open ports
  3. Only run a single zone transfer and stop
  4. Query certificate transparency and passive DNS sources, then brute-force and resolve candidate names Correct answer.

Explanation

Passive sources such as certificate transparency and passive DNS reveal names without touching the target, while active brute-forcing and resolution confirm additional names. Combining both maximizes coverage while controlling noise.

Question 10Web Application Reconnaissance and Enumeration

An application returns a stack trace containing file paths and framework versions after an invalid parameter is supplied. Why is this significant for reconnaissance?

  1. It discloses internal structure and versions that guide targeted exploitation Correct answer.
  2. It proves the application is fully patched
  3. It confirms the server is offline
  4. It indicates the site uses only static HTML

Explanation

Verbose error output leaks framework versions, absolute paths, and sometimes database details, which help a tester select relevant exploits and map the backend. This information disclosure is a reconnaissance win even before any exploit is attempted.

Question 11Web Application Reconnaissance and Enumeration

Which technique helps identify virtual hosts hosted on the same IP address when DNS does not list them?

  1. Running a reverse DNS lookup on the IP
  2. Inspecting the robots.txt file
  3. Sending requests with different Host headers and comparing responses Correct answer.
  4. Querying the MX record for the domain

Explanation

Virtual host enumeration cycles candidate hostnames in the Host header and compares response size, status, or content to detect distinct sites sharing one IP. Reverse DNS and MX records rarely reveal all vhosts, and robots.txt only reflects one site.

Question 12Web Application Reconnaissance and Enumeration

A tester discovers the application exposes its Git repository at /.git/. What is the most valuable reconnaissance outcome of retrieving it?

  1. Gaining root access to the server automatically
  2. Recovering source code and commit history that may reveal secrets and endpoints Correct answer.
  3. Disabling the web application firewall
  4. Obtaining a valid TLS certificate

Explanation

An exposed .git directory allows reconstruction of source code and history, which can contain hardcoded credentials, API keys, and hidden endpoints. This dramatically expands the attack surface for later testing.

Question 13Web Application Reconnaissance and Enumeration

Which HTTP method is often overlooked during enumeration because it can reveal supported operations on an endpoint?

  1. POST
  2. GET
  3. HEAD
  4. OPTIONS Correct answer.

Explanation

An OPTIONS request returns the Allow header listing methods the endpoint supports, which can expose PUT, DELETE, or other risky verbs. Testers use it to map the API surface before attempting each method.

Question 14Web Application Reconnaissance and Enumeration

A tester compares the response time for valid and invalid usernames on a password reset endpoint and finds a consistent delay for valid ones. What does this suggest?

  1. The server is under a denial-of-service attack
  2. The endpoint does not accept usernames
  3. The site is using HTTP/2
  4. A timing side channel that can confirm account existence Correct answer.

Explanation

A consistent timing difference between valid and invalid inputs indicates the backend performs extra work for existing accounts, leaking their existence. This timing side channel is a user enumeration vector worth documenting.

Question 15Web Application Reconnaissance and Enumeration

Which source is most useful for passively discovering hostnames without sending any traffic to the target's infrastructure?

  1. Forced browsing with a wordlist
  2. Direct port scanning
  3. Sending crafted Host headers
  4. Certificate transparency logs Correct answer.

Explanation

Certificate transparency logs are public records of issued certificates and can be queried without touching the target, revealing hostnames passively. Port scanning, forced browsing, and Host header manipulation all send traffic directly to the target.

Question 16Web Application Reconnaissance and Enumeration

You are given a target with a wildcard DNS record where every random subdomain resolves to the same IP. How should subdomain enumeration be adjusted?

  1. Trust every resolution as a valid unique host
  2. Switch to only scanning the primary IP address
  3. Abandon enumeration because no subdomains exist
  4. Filter resolved names by comparing responses against a baseline random subdomain Correct answer.

Explanation

Wildcard DNS causes all names to resolve, producing false positives, so testers must compare each candidate's response against a known-random baseline to filter out the wildcard. Only names whose responses differ are treated as genuine.

Question 17Web Application Reconnaissance and Enumeration

A crawler discovers links to /api/v1/users, /api/v2/users, and /api/v3/users. What is the most useful reconnaissance interpretation?

  1. The site is definitely using REST incorrectly
  2. Multiple API versions exist, and older versions may retain deprecated or weaker endpoints worth testing Correct answer.
  3. The crawler has produced duplicate false positives
  4. The API is read-only and cannot be tested

Explanation

Coexisting API versions suggest legacy endpoints may still be reachable and could lack security controls present in newer versions. Testers should enumerate each version separately rather than assume parity.

Question 18Web Application Reconnaissance and Enumeration

During enumeration you find that the server responds to a request with an X-Powered-By header and a Set-Cookie value whose name matches a known framework. Why combine multiple fingerprinting signals rather than rely on one?

  1. Because headers can be spoofed or stripped, corroborating signals increase confidence in the technology identification Correct answer.
  2. Because headers are always accurate
  3. Because combining signals disables the WAF
  4. Because only cookies matter for fingerprinting

Explanation

Individual signals like X-Powered-By or cookie names can be altered, removed by proxies, or mimic other stacks, so corroborating several independent indicators raises confidence. Misidentification leads to testing the wrong vulnerabilities.

Question 19Web Application Reconnaissance and Enumeration

A tester finds that requesting a directory without a trailing slash returns a 301 redirect to the same path with a slash, while requesting it with a slash returns a 403. What does this pattern most likely indicate?

  1. The directory exists but listing is forbidden, making it a candidate for deeper content discovery Correct answer.
  2. The directory does not exist at all
  3. The path is blocked by DNS
  4. The server is misconfigured to allow directory listing

Explanation

A redirect to the slashed form followed by 403 shows the server recognizes the directory but denies listing, so the directory exists. Testers should then enumerate files within it rather than discard the path.

Question 20Web Application Reconnaissance and Enumeration

Which reconnaissance step best reveals endpoints exposed by a single-page application that are not present in the server-rendered HTML?

  1. Reading the robots.txt file
  2. Running a reverse DNS lookup
  3. Querying the MX records
  4. Reviewing the JavaScript bundles for API routes and fetch calls Correct answer.

Explanation

Single-page applications often embed API routes and fetch calls in their JavaScript bundles, which are not visible in the initial HTML. Extracting these strings uncovers endpoints for later testing.

Question 21Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

During a web application assessment you find that submitting the payload `' OR '1'='1` into a login form's username field returns a valid session without a password. Which class of SQL injection best describes this behavior?

  1. In-band UNION-based injection
  2. Second-order injection
  3. Blind time-based injection
  4. Authentication bypass via tautology Correct answer.

Explanation

A tautology payload such as `' OR '1'='1` alters the WHERE clause so it always evaluates true, letting the query return a row without valid credentials. This is an authentication bypass, a classic in-band (error/boolean-visible) SQLi pattern. UNION and time-based techniques serve data extraction or blind inference, not credential bypass by themselves.

Question 22Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

Which SQL comment sequence is most commonly used to truncate the remainder of a query in MySQL when injecting into a string context?

  1. -- (dash-dash-space)
  2. /*
  3. //
  4. # Correct answer.

Explanation

In MySQL the hash character `#` starts a comment to end of line and is frequently used to terminate an injected query without needing a trailing space. The `-- ` sequence also works in MySQL but requires a following space or control character. `/*` opens a block comment that must be closed with `*/`, and `//` is not a SQL comment in MySQL.

Question 23Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

A UNION-based SQL injection requires the injected SELECT to match the original query. Which property must the injected SELECT share with the original query for the UNION to succeed?

  1. The same table names referenced in the FROM clause
  2. The same WHERE clause predicates
  3. The same ORDER BY clause
  4. The same number and compatible data types of columns Correct answer.

Explanation

UNION combines result sets, so both SELECT statements must return the same number of columns with compatible data types in the same positions. Table names, ORDER BY, and WHERE clauses need not match. Attackers typically determine the column count with ORDER BY or NULL padding before extracting data.

Question 24Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

Which operating system shell metacharacter allows an attacker to chain an additional command that executes regardless of whether the preceding command succeeds?

  1. >
  2. |
  3. &&
  4. ; Correct answer.

Explanation

The semicolon `;` is a command separator in POSIX shells, so the following command runs unconditionally after the first completes. `&&` runs the second command only if the first succeeds, `|` pipes output into the next command, and `>` redirects output to a file. Attackers favor `;` when they need guaranteed execution of a chained payload.

Question 25Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

A PHP application builds a shell command as `ping -c 1 $host` where `$host` is user-controlled. Which input most directly demonstrates command injection?

  1. 127.0.0.1 &&& id
  2. 127.0.0.1
  3. 127.0.0.1 -c 2
  4. 127.0.0.1; id Correct answer.

Explanation

Because `$host` is concatenated into a shell string without escaping, appending `; id` terminates the ping command and executes `id` in the same shell. This is the canonical demonstration of OS command injection through a separator. The other inputs either remain valid ping arguments or contain malformed operator sequences that the shell rejects.

Question 26Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

In a server-side template injection assessment, which pair of inputs is most useful for distinguishing SSTI from plain XSS reflection?

  1. `{{7*7}}` and `${7*7}` Correct answer.
  2. `../../etc/passwd` and `..\..\windows\win.ini`
  3. `' OR 1=1--` and `" OR 1=1--`
  4. `<script>alert(1)</script>` and `"onmouseover=alert(1)`

Explanation

Template engines evaluate expressions inside their delimiters, so `{{7*7}}` (Jinja2/Twig) or `${7*7}` (Freemarker/JSP EL) returning 49 confirms server-side evaluation. XSS payloads only prove client-side reflection, and SQLi or path traversal payloads probe different vulnerability classes. Comparing multiple delimiter styles helps identify the engine.

Question 27Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

Which LDAP filter metacharacter is used to terminate the current filter clause and inject additional conditions into a search query?

  1. `)` Correct answer.
  2. `*`
  3. `\`
  4. `=`

Explanation

LDAP filters are parenthesized expressions such as `(uid=user)`, so an unescaped `)` closes the current clause and lets an attacker append new filter logic. The `*` wildcard and `=` comparison are filter operators, while `\` is the escape character used to neutralize metacharacters. Proper escaping of `( ) * \ NUL` prevents LDAP injection.

Question 28Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

An XPath search builds `//user[username='INPUT' and password='INPUT2']`. Which input for the username field bypasses the password check?

  1. admin' or '1'='1 Correct answer.
  2. admin" or "1"="1
  3. admin) or (1=1
  4. admin] or [1=1

Explanation

XPath string literals are delimited by single quotes, so `admin' or '1'='1` closes the literal and adds a tautological predicate that makes the expression true for the admin node. Double quotes, brackets, and parentheses do not terminate an XPath string literal. The result is an authentication bypass in the XPath query.

Question 29Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

Which technique lets an attacker determine the number of columns returned by a vulnerable query before performing a UNION-based extraction in MySQL?

  1. Appending `DISTINCT` and measuring response time
  2. Appending `GROUP BY 1` and checking for duplicate rows
  3. Appending `ORDER BY n` and incrementing n until an error occurs Correct answer.
  4. Appending `LIMIT 1` and observing the row count

Explanation

Incrementing the ORDER BY column index until the database returns an error reveals how many columns the original query returns, because ordering by a nonexistent column fails. Once the count is known, the attacker crafts a matching UNION SELECT. LIMIT, GROUP BY, and DISTINCT do not reliably disclose the column count.

Question 30Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

A query filters with `WHERE id = $_GET['id']` and the application returns a generic error page for malformed input but a normal page for valid ids. Which blind SQLi technique is most efficient for extracting data under these conditions?

  1. Stacked queries using semicolons
  2. Error-based extraction using EXTRACTVALUE
  3. Out-of-band extraction via DNS exfiltration
  4. Boolean-based inference using true/false conditions Correct answer.

Explanation

When the application reveals only two distinguishable states (normal vs. error/generic page), boolean-based blind injection asks yes/no questions and infers data one bit at a time. Error-based extraction requires verbose database errors, OOB requires egress, and stacked queries are often unsupported. Boolean inference fits the observable signal here.

Question 31Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

An attacker submits `1' AND (SELECT SLEEP(5))-- -` and observes a consistent five-second delay only when the injected condition is true. Which vulnerability class is confirmed?

  1. Server-side request forgery
  2. XML external entity injection
  3. Time-based blind SQL injection Correct answer.
  4. Reflected XSS

Explanation

A conditional time delay controlled by the injected SQL expression confirms that the database executes attacker-supplied logic, which is time-based blind SQLi. The delay is the only observable channel, so no data is returned directly. XSS, SSRF, and XXE produce different observable effects and different payload syntax.

Question 32Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

A login form hashes the submitted password with MD5 in the application and compares it to the stored hash in SQL. Which payload is most likely to bypass authentication?

  1. `' OR 1=1-- -` in the password field only
  2. `admin'/*` in the username field
  3. `' OR '1'='1'-- -` in the username field Correct answer.
  4. `' UNION SELECT 1,2,3-- -` in the password field

Explanation

When the password is hashed before being placed in the query, injecting into the password field cannot create a working tautology because the hash transforms the payload. Injecting a tautology into the username field, however, can make the WHERE clause true for any row and bypass the comparison. This is why input handling must be consistent across all parameters.

Question 33Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

Which mitigation most reliably prevents SQL injection when a query must include user-supplied values?

  1. Blocklisting the word UNION and SELECT
  2. Limiting input length to 32 characters
  3. Parameterized queries with bound placeholders Correct answer.
  4. Escaping single quotes with backslashes

Explanation

Parameterized queries separate SQL code from data, so user input is never parsed as query syntax regardless of content. Escaping and blocklists are bypassable and error-prone, and length limits do not remove injection syntax. Binding placeholders is the primary defense recommended for SQLi.

Question 34Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

An application passes user input to `system("convert " + filename + " out.png")` on Linux. Which input best demonstrates command injection while keeping the convert command valid?

  1. image.png && whoami
  2. image.png; whoami Correct answer.
  3. image.png | whoami
  4. image.png > whoami

Explanation

Appending `; whoami` terminates the convert invocation and runs whoami as a separate command, confirming injection. The `&&` variant also works but requires convert to succeed, while `|` pipes convert output into whoami's stdin and `>` redirects output to a file named whoami. The semicolon form is the most direct unconditional demonstration.

Question 35Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

Why is a blocklist that strips the characters `;` and `&` insufficient to prevent OS command injection in a shell-invoked application?

  1. Only Windows shells support command injection
  2. Blocklists always cause the application to crash before injection
  3. The shell can be reached through newline characters and command substitution syntax such as `$(id)` Correct answer.
  4. The shell ignores all metacharacters when the command is quoted

Explanation

POSIX shells treat newlines as command separators and expand `$(...)` and backticks as command substitution, so removing `;` and `&` leaves multiple execution paths open. Robust defense requires avoiding the shell entirely and using argument-vector APIs. Blocklists cannot enumerate every shell metacharacter reliably.

Question 36Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

A Python application uses `subprocess.run(cmd, shell=True)` with a command string containing user input. Which change most directly removes the command injection risk?

  1. Escaping spaces in the input
  2. Redirecting stderr to /dev/null
  3. Passing an argument list with shell=False Correct answer.
  4. Running the process as a low-privilege user

Explanation

With shell=False and an argument list, the operating system executes the target binary directly without a shell interpreting metacharacters, eliminating shell injection. Escaping spaces does not stop separators, privilege reduction limits impact but not injection, and hiding stderr only affects visibility. Argument-vector execution is the structural fix.

Question 37Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

In Jinja2, which payload is commonly used to confirm SSTI and then begin exploring the object graph for code execution?

  1. `#{7*7}` followed by `#{system('id')}`
  2. `{{7*7}}` followed by `{{config}}` Correct answer.
  3. `<%= 7*7 %>` followed by `<%= system('id') %>`
  4. `@{7*7}` followed by `@{system('id')}`

Explanation

Jinja2 uses `{{ }}` for expressions, so `{{7*7}}` returning 49 confirms evaluation and `{{config}}` exposes application configuration. Attackers then traverse `__class__`/`__mro__`/`__subclasses__` to reach dangerous callables. The other delimiter styles belong to different template engines or are not valid Jinja2 syntax.

Question 38Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

A FreeMarker template renders `${userInput}`. Which payload syntax is appropriate to test for SSTI in this engine?

  1. `<%= 7*7 %>`
  2. `${7*7}` Correct answer.
  3. `{{7*7}}`
  4. `[[7*7]]`

Explanation

FreeMarker evaluates expressions with `${...}`, so `${7*7}` returning 49 indicates server-side evaluation. `{{...}}` is Jinja2/Twig syntax, `<%= %>` is ERB, and `[[...]]` is not a standard FreeMarker expression delimiter. Matching payload delimiters to the engine is essential for accurate detection.

Question 39Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

Which LDAP injection payload is most likely to bypass an authentication filter of the form `(&(uid=INPUT)(userPassword=INPUT2))` when injected into the uid field?

  1. `../../etc/passwd`
  2. `{{7*7}}`
  3. `admin'--`
  4. `*)(uid=*))(|(uid=*` Correct answer.

Explanation

The payload `*)(uid=*))(|(uid=*` closes the uid clause, balances parentheses, and appends a wildcard condition that matches any entry, making the overall filter true. SQL comment syntax, template expressions, and traversal sequences do not affect LDAP filter parsing. This is the classic LDAP authentication bypass pattern.

Question 40Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

An XPath query `//account[user='INPUT' and pass='INPUT2']` is used for login. Which input for the user field produces a bypass while keeping the XPath syntactically valid?

  1. `' or 1=1 or '`
  2. `' and '1'='1`
  3. `' or ''='` Correct answer.
  4. `' or '1'='1`

Explanation

The payload `' or ''='` closes the literal, adds a comparison between two empty strings that is always true, and leaves the remaining XPath structure balanced. It is a well-known XPath bypass that keeps quotes balanced. Payloads with unbalanced quotes or trailing operators often break the expression.

Question 41Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

An application stores a username containing `' OR 1=1-- -` during registration and later uses that stored value unescaped in an administrative report query. Which term describes this vulnerability?

  1. Second-order SQL injection Correct answer.
  2. Out-of-band SQL injection
  3. Reflected SQL injection
  4. Blind SQL injection

Explanation

Second-order SQL injection occurs when a payload is stored safely at first but later concatenated into a query without parameterization, executing in a different code path. The initial insert may be harmless, which is why the payload survives validation. Reflected, blind, and out-of-band describe other delivery or observation channels.

Question 42Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

A database account used by a web application has only SELECT privileges on one schema. Which impact is most directly limited by this configuration after a successful SQL injection?

  1. Causing time delays with SLEEP
  2. Confirming that the injection point exists
  3. Extracting rows from the permitted schema
  4. Reading data from other schemas and modifying or dropping tables Correct answer.

Explanation

Least-privilege database accounts limit an injection to the permissions granted, so an attacker with only SELECT on one schema cannot read other schemas or alter data. Confirming the injection, reading permitted rows, and inducing delays remain possible. This is why per-application, minimal-privilege accounts are a defense-in-depth control.

Question 43Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

During SSTI testing against a Twig application, which payload sequence best confirms server-side evaluation and then attempts to reach the underlying PHP environment?

  1. `{{7*7}}` then `{{_self.env.registerUndefinedFilterCallback('system')}}` Correct answer.
  2. `<%= 7*7 %>` then `<%= system('id') %>`
  3. `${7*7}` then `${system('id')}`
  4. `#{7*7}` then `#{system('id')}`

Explanation

Twig uses `{{ }}` delimiters, so `{{7*7}}` returning 49 confirms evaluation, and Twig-specific object access such as `_self.env` can be abused in vulnerable versions to register callbacks. The `${}` form is FreeMarker/JSP EL, `#{}` is Ruby interpolation, and `<%= %>` is ERB. Engine-specific syntax matters for both detection and exploitation.

Question 44Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

A MySQL injection point returns no data and produces no errors, but the server can resolve external DNS names. Which approach is most suitable for exfiltrating query results?

  1. Out-of-band extraction using a function such as LOAD_FILE or UNC path resolution to trigger DNS lookups Correct answer.
  2. Stacked INSERT statements to write results to a file
  3. Boolean-based inference over many requests
  4. UNION SELECT to print results in the response

Explanation

Out-of-band SQLi uses database features that cause the server to make network requests, such as DNS resolution of attacker-controlled hostnames, to carry extracted data. This is preferred when in-band and error channels are unavailable and boolean inference would be slow. UNION and file writes require visible output or write privileges that are not indicated.

Question 45Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

An attacker exploits SSTI in a Jinja2 sandbox and needs to reach `os.system` without direct access to builtins. Which traversal is the standard path through Python object internals?

  1. `{{ ''.__class__.__mro__[1].__subclasses__() }}` Correct answer.
  2. `{{ ''.__proto__.__constructor__ }}`
  3. `{{ request.application.__globals__ }}`
  4. `{{ self.env.get('system') }}`

Explanation

In Jinja2 exploitation, `''.__class__.__mro__` reaches `object`, and `__subclasses__()` enumerates loaded classes so an attacker can find one that provides file or command access. This is the canonical object-graph traversal taught for Python SSTI. The other expressions use JavaScript prototype syntax, Twig-specific access, or Flask internals that are not the standard generic traversal.

Question 46Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

Which SQL comment syntax terminates the remainder of a MySQL query so that a trailing quote in the original statement is neutralized?

  1. #!
  2. -- followed by a space Correct answer.
  3. --%
  4. /*! ... */

Explanation

In MySQL the double dash only starts a comment when followed by whitespace or a control character, so `-- ` (dash dash space) is the canonical terminator used to neutralize trailing syntax. The versioned comment `/*! */` executes its contents rather than discarding them, and `#` alone comments to end of line without needing a space.

Question 47Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

An application builds an LDAP search filter as `(cn=INPUT)` and binds anonymously. Which payload causes the filter to match every entry in the directory?

  1. `*)(|(cn=*`
  2. `*))%00`
  3. `*` alone Correct answer.
  4. `)(cn=*)(`

Explanation

A filter value of `*` is the presence wildcard, so `(cn=*)` matches any entry that has a cn attribute, which is effectively every user object. This is the simplest LDAP wildcard bypass and requires no filter-breaking characters.

Question 48Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

A web app concatenates the header `X-Forwarded-For` into a shell command that runs `nslookup <value>`. Which input confirms command injection while producing observable output in the HTTP response?

  1. `| cat /etc/passwd`
  2. `&& sleep 5`
  3. `$(whoami)`
  4. `; id` Correct answer.

Explanation

A semicolon terminates the nslookup invocation and runs `id`, whose stdout is returned in the same response stream, giving immediate confirmation. The other payloads either rely on timing, depend on output redirection, or are subject to shell expansion that may not surface in the response.

Question 49Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

A PHP application builds `SELECT * FROM users WHERE name = '$name'` and passes user input through `mysqli_real_escape_string`. Which input still breaks out of the string literal?

  1. `%27 OR 1=1-- -`
  2. `'' OR 1=1-- -`
  3. `\' OR 1=1-- -` Correct answer.
  4. `' OR 1=1-- -`

Explanation

`mysqli_real_escape_string` escapes the quote by prefixing a backslash, but when the input already begins with a backslash the escaping produces `\'`, which the SQL parser reads as a literal backslash followed by an unescaped quote. This is the classic multibyte/backslash escape bypass and is why parameterized queries are preferred.

Question 50Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)

A Node.js service runs `exec('ping -c 1 ' + host)` where `host` is user-controlled. Which input works even if the application strips semicolons and ampersands?

  1. `; whoami`
  2. `` `whoami` `` Correct answer.
  3. `| whoami`
  4. `&& whoami`

Explanation

Backticks trigger command substitution inside the shell, so the output of `whoami` is substituted into the ping argument without needing a command separator. Filtering semicolons and ampersands does not block substitution syntax, which is why shell metacharacter blocklists are unreliable.