Web and application pentesting: understanding vulnerabilities Quiz

Quiz: injection flaws

Pass mark: 70%. You can retry as many times as you need.

1 What is the root cause of an SQL injection vulnerability? Single answer The database is installed on the same server as the web application The website does not use HTTPS The application concatenates user input into the query so data becomes part of the command The database uses SQL instead of a NoSQL engine

2 In a lab, you send a single apostrophe in a parameter and the page displays a database syntax error. What is the correct conclusion? (several answers) Multiple answers possible It is strong evidence that the input reaches an SQL query It proves the application is secure because it detected the error You should confirm with controlled true/false tests and record the evidence In a real engagement you stop at the minimum proof and do not dump data

3 A network diagnostic page runs a system command built with the host name typed by the user. Which injection type should be on your test list? Single answer OS command injection LDAP injection Cross-site scripting Session fixation

4 A developer wants to let users sort a product list by column using a sort parameter. Which approach is safest? Single answer Concatenate the value and remove quote characters Use a drop-down on the page so users can only pick valid columns Add a placeholder for the column name in a prepared statement Check the value against an allowlist of column names defined in the code

5 Which measures effectively reduce the risk and impact of injection flaws? (several answers) Multiple answers possible Parameterised queries (prepared statements) Relying only on a web application firewall A least-privilege database account for the application Generic error messages for visitors, detailed logs on the server