Detailed Explanations for Questions 376-425
Q376 & Q401. What method of exploitation might allow the adversary to pass arbitrary SQL queries within the URL?
- A. SQL injection ✓
- B. XSS
- C. Spear phishing
- D. Ruby on Rails injection method
Why A is correct: SQL injection occurs when an attacker inserts or “injects” malicious SQL code into input fields that are passed to a backend database. When user input is not properly sanitized or parameterized, the injected SQL code can be executed by the database server. URLs are a common injection point because query parameters (e.g., ?id=1) are often directly concatenated into SQL queries without proper validation.
Why others are incorrect:
- B: XSS (Cross-Site Scripting) injects client-side scripts (JavaScript) into web pages viewed by other users; it targets the browser, not the database
- C: Spear phishing is a targeted social engineering attack using email, not a technical web exploitation technique
- D: “Ruby on Rails injection method” is not a standard attack classification; while Rails applications can be vulnerable to SQL injection, the attack itself is still called SQL injection
Q377 & Q402. Which input value would you utilize in order to evaluate and test for SQL injection vulnerabilities?
- A. SQL test
- B. admin and password
- C. || or |!
- D. 1=1′ ✓
Why D is correct: The input 1=1' is a classic SQL injection test payload. The 1=1 condition always evaluates to TRUE, and the trailing single quote (') is used to break out of a string literal in the SQL query. If the application is vulnerable, this payload may cause the query to return all records or generate a database error that reveals information about the database structure.
Why others are incorrect:
- A: “SQL test” is not a valid SQL injection payload; it’s just a generic phrase
- B: “admin and password” might be used for credential testing but doesn’t test for SQL injection vulnerabilities
- C:
|| or |!is not valid SQL syntax for injection testing;||is a logical OR in some SQL dialects, but the syntax shown is malformed
Q378 & Q403. Which method would be targeting the client in a web-based communication?
- A. Cross-site scripting (XSS) ✓
- B. SQL injection
- C. XML external entity
- D. Command injection
Why A is correct: Cross-Site Scripting (XSS) is a client-side attack where malicious scripts (typically JavaScript) are injected into web pages viewed by other users. The malicious code executes in the victim’s browser, allowing the attacker to steal cookies, session tokens, or perform actions on behalf of the user.
Why others are incorrect:
- B: SQL injection targets the server-side database, not the client browser
- C: XML External Entity (XXE) injection targets the server-side XML parser
- D: Command injection targets the server’s operating system by injecting OS commands
Q379, Q385, Q386, Q404, Q410, Q411. What type of attack is being used if you were to see <!ENTITY xxe SYSTEM "file:///etc/passwd"> in your web server logs?
- A. SQL injection
- B. XSS
- C. Command injection
- D. XXE ✓
Why D is correct: This is a classic XML External Entity (XXE) injection payload. The <!ENTITY> declaration defines an external entity that references a local file (file:///etc/passwd). When the vulnerable XML parser processes this entity, it may read and include the contents of the specified file in the response, allowing attackers to access sensitive server files.
Why others are incorrect:
- A: SQL injection payloads contain SQL syntax (SELECT, UNION, DROP, etc.), not XML entity declarations
- B: XSS payloads contain JavaScript or HTML tags (
<script>,onerror=, etc.), not XML DTD declarations - C: Command injection payloads contain OS commands (
cat,ls,;,&&,|), not XML entity syntax
Q380 & Q405. Which option describes a server-side attack targeting web applications?
- A. SQL injection ✓
- B. Cross-site malware injection
- C. Cross-site scripting
- D. SQL site scripting
Why A is correct: SQL injection is a server-side attack because the malicious SQL code is executed on the backend database server. The attacker manipulates input that gets incorporated into SQL queries, allowing unauthorized database access, data extraction, or even server compromise.
Why others are incorrect:
- B: “Cross-site malware injection” is not a standard attack classification
- C: Cross-site scripting (XSS) is a client-side attack that executes in the victim’s browser
- D: “SQL site scripting” is not a real attack type; this appears to be a distractor combining SQL injection and XSS terminology
Q381, Q382, Q406, Q407. Which of these attacks targets the client in a web application?
- A. XML external entity
- B. Cross-site scripting ✓
- C. SQL injection
- D. Command injection
Why B is correct: Cross-site scripting (XSS) specifically targets the client (user’s browser). The malicious script executes in the victim’s browser context, allowing the attacker to steal session cookies, redirect users, or perform actions as the authenticated user.
Why others are incorrect:
- A: XXE targets the server-side XML parser
- C: SQL injection targets the backend database server
- D: Command injection targets the server’s operating system
Q383, Q384, Q408, Q409. What type of attack is being used if you were to see <!ENTITY xxe SYSTEM in your logs?
- A. XML entity injection ✓
- B. Cross-site scripting
- C. Command injection
- D. Cross-site request forgery
Why A is correct: The <!ENTITY xxe SYSTEM fragment is the beginning of an XML External Entity declaration, which is the hallmark of XXE (XML External Entity) injection attacks. Even without the complete payload, this fragment indicates an attempt to define an external entity that could be used to access server resources.
Why others are incorrect:
- B: XSS payloads would contain HTML/JavaScript tags, not XML DTD syntax
- C: Command injection would show OS command syntax, not XML entity declarations
- D: CSRF attacks involve forged requests from a victim’s browser, not XML entity injection in logs
Q387, Q388, Q412, Q413. Which of the following would you not be able to access using an XML external entity injection attack?
- A. Internal web page
- B. File on the target system
- C. User cookie from the browser ✓
- D. Network configuration
Why C is correct: XXE attacks execute on the server side where the XML is parsed. The attacker can access server-side resources like files, internal URLs, or network configurations that the server can reach. However, XXE cannot access client-side browser data like user cookies because the attack doesn’t execute in the victim’s browser.
Why others are incorrect:
- A: XXE can access internal web pages via server-side HTTP requests (SSRF)
- B: XXE can read local files on the server using
file://URIs - D: XXE can potentially access network configuration files stored on the server
Q389, Q390, Q414, Q415. Which of the following allows the adversary to jump from the web directory to another part of the file system?
- A. Directory traversal ✓
- B. Pivoting
- C. Directory hopping
- D. Directory shifting
Why A is correct: Directory traversal (also called path traversal) attacks use sequences like ../ to navigate outside the web root directory. By manipulating file path parameters, attackers can access files anywhere on the server’s filesystem that the web server process has permission to read (e.g., /etc/passwd, configuration files, source code).
Why others are incorrect:
- B: Pivoting refers to using a compromised system to attack other network segments, not file system navigation
- C: “Directory hopping” is not a standard security term
- D: “Directory shifting” is not a standard security term
Q391, Q392, Q416, Q417. As seen in the following screen shot, what is the adversary trying to do in the URL bar in the web browser? (Directory Traversal)
- A. Privilege escalation
- B. Directory traversal ✓
- C. Blind SQL injection
- D. Deletion of a table in SQL
Why B is correct: Based on the question context indicating “Directory Traversal” in the screenshot description, the attacker is using path traversal sequences (like ../../../) in the URL to access files outside the intended web directory. This is a classic directory traversal attack pattern.
Why others are incorrect:
- A: Privilege escalation involves gaining higher system permissions, not file path manipulation
- C: Blind SQL injection involves injecting SQL queries where results aren’t directly visible; it uses SQL syntax, not path traversal sequences
- D: Deleting a SQL table would use SQL syntax like
DROP TABLE, not path traversal characters
Q393, Q394, Q418, Q419. This fragment is found in web server logs. What kind of attack is likely to be happening? && cat /etc/shadow
- A. SQL injection
- B. XML external entity
- C. Cross-site request forgery
- D. Command injection ✓
Why D is correct: The fragment && cat /etc/shadow contains shell command syntax: && is a shell operator that executes the next command if the previous one succeeds, and cat /etc/shadow is a Linux command to display the contents of the password hash file. This indicates a command injection attack where the attacker is trying to execute OS commands through a vulnerable web application.
Why others are incorrect:
- A: SQL injection would contain SQL keywords (SELECT, UNION, DROP), not shell commands
- B: XXE would contain XML entity declarations (
<!ENTITY), not shell syntax - C: CSRF involves forged requests from a victim’s browser, not direct command execution in logs
Q395, Q396, Q420, Q421. As a black hat, you are sending inputs to a web application to be sent to the LDAP server. What are you trying to conduct?
- A. SQL injection
- B. X.25 injection
- C. LDAP injection ✓
- D. LDAP fuzzing
Why C is correct: LDAP injection occurs when user input is improperly sanitized before being incorporated into LDAP queries. Attackers can inject LDAP metacharacters (like *, ), |, &) to manipulate directory queries, potentially bypassing authentication or extracting sensitive directory information.
Why others are incorrect:
- A: SQL injection targets SQL databases, not LDAP directory services
- B: X.25 is an obsolete packet-switched network protocol, not related to web application injection attacks
- D: “LDAP fuzzing” is not a standard attack classification; fuzzing is a testing technique, not a specific injection attack
Q397, Q398, Q422, Q423. What would you use to inspect HTTP messages to determine whether there was attack traffic in the message so a decision could be made about whether to allow the traffic or not?
- A. Stateful firewall
- B. Anti-malware
- C. Load balancer
- D. Web application firewall ✓
Why D is correct: A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at Layer 7 (Application layer). It can detect and block common web attacks like SQL injection, XSS, and XXE by analyzing request patterns, headers, and payloads against known attack signatures and behavioral rules.
Why others are incorrect:
- A: Stateful firewalls operate at Layers 3-4 and filter based on IP/port/state, not application-layer content
- B: Anti-malware scans files for malicious code but doesn’t inspect HTTP traffic in real-time for attack patterns
- C: Load balancers distribute traffic across servers but don’t typically inspect content for attack detection
Q399, Q400, Q424, Q425. As a security administrator, your web application firewall logs show the following. What do you think is going on? 10; DROP TABLE users--
- A. CSRF
- B. SQLI ✓
- C. XSS
- D. XXE
Why B is correct: This is a classic SQL injection (SQLI) payload. The semicolon (;) terminates the intended query, DROP TABLE users is a destructive SQL command to delete the users table, and -- comments out the rest of the original query. This payload attempts to delete the entire users table from the database.
Why others are incorrect:
- A: CSRF (Cross-Site Request Forgery) involves tricking a user’s browser into making unauthorized requests, not injecting SQL commands
- C: XSS payloads contain JavaScript/HTML, not SQL commands
- D: XXE payloads contain XML entity declarations, not SQL syntax
Key Takeaways for Module 14: Hacking Web Applications
- SQL Injection: Server-side attack using SQL syntax (
1=1','; DROP TABLE--) to manipulate database queries. Test with payloads that break query structure. - Cross-Site Scripting (XSS): Client-side attack injecting JavaScript into web pages. Targets user browsers to steal sessions or perform actions.
- XML External Entity (XXE): Server-side attack using XML entity declarations (
<!ENTITY xxe SYSTEM) to access server files or internal resources. Cannot access client-side data like browser cookies. - Directory Traversal: Uses path sequences (
../) to access files outside the web root. Targets server filesystem, not databases or clients. - Command Injection: Injects OS commands (
&& cat /etc/shadow) through vulnerable input fields. Executes on the server’s operating system. - LDAP Injection: Manipulates LDAP queries using metacharacters (
*,),|) to bypass authentication or extract directory data. - Web Application Firewall (WAF): Layer 7 security device that inspects HTTP traffic for attack patterns and can block malicious requests in real-time.
- Attack Targeting:
- Client-side: XSS
- Server-side: SQL injection, XXE, command injection, LDAP injection, directory traversal
Study Tip: Practice identifying attack types by their syntax patterns:
- SQL:
SELECT,UNION,DROP,--,'- XSS:
<script>,onerror=,javascript:- XXE:
<!ENTITY,SYSTEM,file://- Command injection:
;,&&,|,cat,ls- Directory traversal:
../,..%2f,%2e%2e/
Use tools like Burp Suite or OWASP ZAP to test web applications for these vulnerabilities in a controlled lab environment. Always obtain proper authorization before testing any system.
Copy
Ask Qwen
Explain
Translate(en-US)
