Chapter 44 Quiz: Web Application Penetration Testing¶
Test your knowledge of the OWASP Top 10, SQL injection types, cross-site scripting, SSRF, XXE, JWT attacks, and API security testing.
Questions¶
1. A web application constructs SQL queries using string concatenation: SELECT * FROM users WHERE id = ' + userInput + '. An attacker submits ' OR '1'='1' --. What type of SQL injection is this, and why does it succeed?
- A) Blind SQL injection — the attacker cannot see the query results
- B) Classic (in-band) SQL injection — the unsanitized input modifies the query logic to return all rows by making the WHERE condition always true
- C) Second-order SQL injection — the payload is stored and executed later
- D) Out-of-band SQL injection — results are exfiltrated via DNS
Answer
B — Classic (in-band) SQL injection — the unsanitized input modifies the query logic to return all rows by making the WHERE condition always true
String concatenation without parameterized queries allows attacker input to break out of the intended SQL context. The injected ' OR '1'='1' -- closes the original string literal, adds an always-true condition (OR '1'='1'), and comments out the rest of the query. This is in-band SQLi because results are returned directly in the application's response. Parameterized queries (prepared statements) prevent this by separating data from code.
2. An attacker discovers that a web application returns different error messages for valid vs. invalid usernames during login. The application responds "Invalid password" for existing users and "User not found" for non-existent users. What vulnerability does this represent?
- A) SQL injection
- B) Username enumeration through differential response analysis, classified under OWASP A07:2021 Identification and Authentication Failures
- C) Cross-site scripting (XSS)
- D) Insecure direct object reference (IDOR)
Answer
B — Username enumeration through differential response analysis, classified under OWASP A07:2021 Identification and Authentication Failures
Different error messages for valid vs. invalid usernames allow attackers to enumerate valid accounts before attempting password attacks. This falls under OWASP A07:2021 (Identification and Authentication Failures). Secure applications should return a generic message like "Invalid credentials" regardless of whether the username or password was incorrect, and implement consistent response timing to prevent timing-based enumeration.
3. What is the key difference between Reflected XSS and Stored XSS in terms of attack persistence and delivery?
- A) Reflected XSS is more severe than Stored XSS
- B) Reflected XSS requires the victim to click a crafted link containing the payload; Stored XSS persists in the application's database and executes for every user who views the affected page
- C) Reflected XSS works only in Internet Explorer; Stored XSS works in all browsers
- D) Reflected XSS targets servers; Stored XSS targets clients
Answer
B — Reflected XSS requires the victim to click a crafted link containing the payload; Stored XSS persists in the application's database and executes for every user who views the affected page
Reflected XSS payloads are embedded in URLs or form submissions and reflected back in the response — they require victim interaction with a crafted link. Stored XSS payloads are persisted server-side (in databases, comments, profiles) and execute automatically when any user views the affected content. Stored XSS is generally higher impact because it affects all visitors without requiring individual targeting.
4. A penetration tester discovers that a web application's "profile picture upload" feature accepts URLs and fetches images from them. The tester submits http://169.254.169.254/latest/meta-data/iam/security-credentials/. What vulnerability is being tested?
- A) Remote File Inclusion (RFI)
- B) Server-Side Request Forgery (SSRF) targeting cloud instance metadata services
- C) XML External Entity (XXE) injection
- D) Open redirect vulnerability
Answer
B — Server-Side Request Forgery (SSRF) targeting cloud instance metadata services
SSRF occurs when an application can be tricked into making HTTP requests to arbitrary destinations from the server side. The URL 169.254.169.254 is the AWS EC2 Instance Metadata Service (IMDS) endpoint. Successful SSRF to this endpoint can expose IAM role credentials, allowing the attacker to access AWS services with the instance's permissions. This is classified under OWASP A10:2021 (Server-Side Request Forgery).
5. An application parses XML input and the following payload is submitted:
What vulnerability does this exploit, and what is the root cause?- A) SQL injection through XML data
- B) XML External Entity (XXE) injection — the XML parser processes external entity declarations that reference local files or external resources
- C) Cross-site scripting via XML injection
- D) Server-side template injection (SSTI)
Answer
B — XML External Entity (XXE) injection — the XML parser processes external entity declarations that reference local files or external resources
XXE exploits XML parsers configured to process Document Type Definitions (DTDs) and external entities. The SYSTEM keyword instructs the parser to fetch the contents of /etc/passwd and include it in the parsed document. Mitigation requires disabling DTD processing and external entity resolution in the XML parser configuration. XXE falls under OWASP A05:2021 (Security Misconfiguration).
6. A JWT (JSON Web Token) uses the alg header set to HS256. An attacker changes the algorithm to none and removes the signature. If the server accepts this token, what vulnerability is present?
- A) Broken access control — the server does not enforce role-based permissions
- B) JWT algorithm confusion — the server fails to enforce the expected signing algorithm and accepts unsigned tokens
- C) Insecure deserialization of the JWT payload
- D) Cross-site request forgery via JWT manipulation
Answer
B — JWT algorithm confusion — the server fails to enforce the expected signing algorithm and accepts unsigned tokens
The alg: none attack exploits JWT libraries that accept the algorithm specified in the token header without server-side validation. By changing the algorithm to "none" and removing the signature, the attacker creates a valid-looking token that bypasses signature verification. Secure implementations must enforce a whitelist of allowed algorithms server-side and reject tokens with unexpected algorithm values.
7. During API testing, a penetration tester discovers that changing the user ID in the API endpoint /api/users/1234/profile to /api/users/1235/profile returns another user's data. What vulnerability is this?
- A) SQL injection
- B) Broken Object Level Authorization (BOLA/IDOR) — the API does not verify that the authenticated user is authorized to access the requested resource
- C) Mass assignment vulnerability
- D) Server-side request forgery
Answer
B — Broken Object Level Authorization (BOLA/IDOR) — the API does not verify that the authenticated user is authorized to access the requested resource
BOLA (Broken Object Level Authorization), also known as IDOR (Insecure Direct Object Reference), occurs when the API relies on client-supplied object IDs without verifying that the authenticated user has permission to access that specific object. This is the #1 vulnerability in the OWASP API Security Top 10 (API1:2023). Remediation requires server-side authorization checks on every object access.
8. What is the primary purpose of a Content Security Policy (CSP) header, and which vulnerability class does it primarily mitigate?
- A) CSP prevents SQL injection by blocking database queries from untrusted sources
- B) CSP controls which sources of content (scripts, styles, images) the browser is allowed to load, primarily mitigating Cross-Site Scripting (XSS) attacks
- C) CSP encrypts data in transit between the browser and server
- D) CSP prevents clickjacking by controlling iframe embedding
Answer
B — CSP controls which sources of content (scripts, styles, images) the browser is allowed to load, primarily mitigating Cross-Site Scripting (XSS) attacks
Content Security Policy is an HTTP response header that instructs browsers to only load resources (JavaScript, CSS, images, fonts, frames) from explicitly whitelisted sources. Even if an attacker successfully injects a script tag via XSS, the browser will refuse to execute it if the script's source violates the CSP policy. Effective CSP configurations avoid unsafe-inline and unsafe-eval directives.
9. A penetration tester finds that a web application uses render(template_string) where template_string includes user input directly. Submitting {{7*7}} returns 49 in the response. What vulnerability is present?
- A) Cross-site scripting (XSS)
- B) Server-Side Template Injection (SSTI) — user input is evaluated as template code on the server
- C) Command injection
- D) Expression Language injection in the client browser
Answer
B — Server-Side Template Injection (SSTI) — user input is evaluated as template code on the server
SSTI occurs when user input is embedded directly into server-side template engine code rather than passed as data. The expression {{7*7}} being evaluated to 49 confirms that the template engine (Jinja2, Twig, Freemarker, etc.) is processing user input as executable code. SSTI can escalate to remote code execution through template engine-specific payload chains that access the underlying runtime environment.
10. Which OWASP Top 10 (2021) category addresses vulnerabilities where applications fail to properly validate, filter, or sanitize user-supplied data before using it in operating system commands?
- A) A01:2021 — Broken Access Control
- B) A03:2021 — Injection
- C) A05:2021 — Security Misconfiguration
- D) A08:2021 — Software and Data Integrity Failures
Answer
B — A03:2021 — Injection
OWASP A03:2021 (Injection) encompasses all injection flaws including SQL injection, command injection, LDAP injection, and XPath injection. Command injection specifically occurs when user input is passed to operating system shell commands without proper sanitization. The primary defense is never passing user input directly to system commands; when unavoidable, use parameterized APIs, input validation, and least-privilege execution contexts.
11. A tester discovers that a web application's password reset function sends a reset token via URL parameter: https://app.target.com/reset?token=abc123. The token is also visible in the Referer header when the user clicks external links on the reset page. What vulnerabilities does this create?
- A) Only a cosmetic issue — tokens in URLs are standard practice
- B) Token leakage via browser history, server logs, proxy logs, and Referer headers, enabling account takeover if an attacker obtains the token
- C) SQL injection through the token parameter
- D) Cross-site request forgery via the reset endpoint
Answer
B — Token leakage via browser history, server logs, proxy logs, and Referer headers, enabling account takeover if an attacker obtains the token
Sensitive tokens in URL parameters are exposed through multiple channels: browser history, web server access logs, proxy logs, analytics platforms, and Referer headers sent to third-party resources. Any of these leakage points could allow an attacker to obtain a valid reset token and take over the account. Secure implementations deliver tokens via POST bodies or short-lived, single-use tokens with Referrer-Policy headers set to no-referrer.
12. During API security testing, a tester sends a POST request to create a user account and includes additional fields not shown in the UI: {"username":"test","role":"admin"}. The API accepts the role field and creates an admin account. What vulnerability is this?
- A) Privilege escalation through broken authentication
- B) Mass Assignment (Excessive Data Exposure) — the API binds all client-supplied fields to the data model without filtering
- C) SQL injection via JSON parameter
- D) BOLA/IDOR vulnerability
Answer
B — Mass Assignment (Excessive Data Exposure) — the API binds all client-supplied fields to the data model without filtering
Mass Assignment occurs when an API automatically binds client-supplied JSON/form parameters to internal data model properties without a whitelist. Attackers can inject additional fields (role, isAdmin, balance, permissions) that the API processes despite not being exposed in the UI. This is API6:2023 in the OWASP API Security Top 10. Remediation requires explicit property whitelisting on the server side.
13. What is the primary difference between blind Boolean-based SQL injection and blind time-based SQL injection?
- A) Boolean-based works only on MySQL; time-based works on all databases
- B) Boolean-based infers data from true/false differences in application responses; time-based infers data from deliberate delays introduced by SQL sleep functions when conditions are true
- C) Boolean-based is faster than time-based but less reliable
- D) Boolean-based requires error messages; time-based does not
Answer
B — Boolean-based infers data from true/false differences in application responses; time-based infers data from deliberate delays introduced by SQL sleep functions when conditions are true
In blind Boolean-based SQLi, the attacker crafts conditions (e.g., AND SUBSTRING(password,1,1)='a') and observes response differences (different content, status codes, or page behavior) for true vs. false conditions. In time-based blind SQLi, the attacker uses database-specific sleep functions (e.g., WAITFOR DELAY '0:0:5' in MSSQL, SLEEP(5) in MySQL) to introduce measurable delays when conditions are true, extracting data one bit at a time.
14. A web application uses the HTTP header X-Frame-Options: DENY. What attack does this header prevent?
- A) Cross-site scripting (XSS)
- B) Clickjacking — where an attacker embeds the target site in a transparent iframe and tricks users into clicking invisible elements
- C) SQL injection via HTTP headers
- D) Man-in-the-middle attacks
Answer
B — Clickjacking — where an attacker embeds the target site in a transparent iframe and tricks users into clicking invisible elements
Clickjacking (UI redressing) overlays a transparent iframe of the target application over an attacker-controlled page, tricking users into performing unintended actions (changing settings, transferring funds) by clicking what appears to be benign content. X-Frame-Options: DENY instructs browsers to refuse rendering the page inside any iframe. The modern replacement is the CSP frame-ancestors directive.
15. A penetration tester discovers that an application's REST API returns verbose error messages including stack traces, database query details, and internal IP addresses when requests fail. Under OWASP 2021, which category does this fall under, and why is it significant?
- A) A01:2021 — Broken Access Control — because error messages bypass access restrictions
- B) A05:2021 — Security Misconfiguration — verbose error messages expose implementation details that aid further attacks such as SQL injection refinement and infrastructure mapping
- C) A09:2021 — Security Logging and Monitoring Failures — because errors are being logged to the response
- D) A06:2021 — Vulnerable and Outdated Components — because the stack trace reveals component versions
Answer
B — A05:2021 — Security Misconfiguration — verbose error messages expose implementation details that aid further attacks such as SQL injection refinement and infrastructure mapping
Verbose error messages are a classic security misconfiguration. Stack traces reveal framework versions, database types, file paths, and query structures. Internal IP addresses expose network architecture. This information helps attackers refine injection payloads, identify vulnerable components, and map internal infrastructure. Production applications should return generic error messages and log detailed errors server-side only.
Scoring¶
| Score | Performance |
|---|---|
| 14–15 | Expert — Web application penetration testing concepts fully internalized |
| 11–13 | Proficient — Ready to conduct structured web application assessments |
| 8–10 | Developing — Review Chapter 44 OWASP Top 10 and injection technique sections |
| <8 | Foundational — Re-read Chapter 44 before proceeding |
Return to Chapter 44 | Next: Chapter 45 Quiz