Unit 4: Web Application Exploitation - Practice Quiz

1 Which organization manages the standard awareness document for developers and web application security known as the 'Top 10'?

2 In the context of OWASP Top 10, which vulnerability allows an attacker to access unauthorized functionality or data, such as viewing another user's account details by simply changing a URL parameter?

3 Which attack involves an attacker stealing a valid session ID to gain unauthorized access to a web server?

4 What is the primary mechanism of a Cross-Site Request Forgery (CSRF) attack?

5 Which input would most likely be used to test for a basic SQL Injection vulnerability?

6 What is the primary defense mechanism against SQL Injection attacks?

7 Which type of XSS attack occurs when the malicious script is permanently stored on the target server (e.g., in a database or forum post)?

8 In a DOM-based XSS attack, where does the security vulnerability lie?

9 Which flag should be set on a Set-Cookie HTTP response header to prevent client-side scripts (like XSS payloads) from accessing the cookie?

10 BeEF is a popular penetration testing tool. What does the acronym stand for?

11 Which SQL injection technique involves asking the database true/false questions and determining the answer based on the application's response time?

12 What is the mathematical logic often used in tautology-based SQL injection?

13 Which mobile deployment model allows employees to use their personal devices for work but requires them to install a Mobile Device Management (MDM) agent?

14 Which OWASP Mobile Top 10 vulnerability refers to the storage of sensitive data (like passwords or API keys) in plain text within the device's file system?

15 What is 'Jailbreaking' in the context of mobile security?

16 Which Bluetooth attack involves sending unsolicited messages (often vCards or images) to a Bluetooth-enabled device?

17 Which Bluetooth attack allows an attacker to steal data (contacts, calendars, emails) from a device?

18 Which tool is commonly used to automate the detection and exploitation of SQL injection flaws?

19 What does a 'Union-based' SQL injection allow an attacker to do?

20 Which social engineering attack targets mobile users via SMS messages containing malicious links?

21 In the context of browser exploitation, what is a 'hook'?

22 Which mitigation technique involves generating a unique random token for every user session and validating it with every state-changing request to prevent CSRF?

23 What is 'Bluebugging'?

24 Which vulnerability allows an attacker to inject malicious code into a website that is then executed by other users?

25 Which COPE deployment model stands for?

26 Which type of malware disguises itself as legitimate software to trick the user into installing it?

27 What is the primary risk associated with 'Side-Loading' apps on Android?

28 Which attack involves an attacker creating a fake mobile transmission tower to intercept mobile traffic?

29 Identify the vulnerability: An application allows uploading a file named shell.php without validating the file type.

30 Which component is essential for a 'Reflected XSS' attack to succeed?

31 What does the 'SameSite' cookie attribute helps prevent?

32 Which of the following is a symptom of a mobile device being infected with spyware?

33 Reverse engineering an Android app (APK) is often used in penetration testing to:

34 Which attack involves overlaying a legitimate application with a fake window to trick users into entering sensitive data on a mobile device?

35 In SQL Injection, what is the purpose of the -- or # characters?

36 Which of the following represents a 'Blind' SQL Injection scenario?

37 Which mobile vulnerability involves an app accidentally sharing access to its components (Activities, Services) with other malicious apps?

38 What is 'Vishing'?

39 Which technique is used to bypass mobile device screen locks using residues left by fingers?

40 Which of the following is a valid method to secure a session ID?

41 Malware that encrypts a user's files and demands payment for the decryption key is known as:

42 In the context of malware, what is a 'Wrapper' or 'Binder'?

43 What is the function of a C2 (Command and Control) server in a malware attack?

44 Which encoding is often used in XSS payloads to bypass basic keyword filters (e.g., converting < to %3C)?

45 What is 'Session Fixation'?

46 Which tool is specifically designed for decompiling Android applications into readable Java source code?

47 If an attacker inputs admin' -- into a login field, they are attempting to bypass authentication via:

48 Which of the following is an example of a Social Engineering attack utilizing authority?

49 What defines a 'Hybrid' mobile application?

50 Which mathematical concept is primarily compromised when an attacker successfully performs a 'Integer Overflow' attack on a web application?