GWAPT Practice Questions: Configuration, Command Injection & Flaws Domain

Correct Answer: A

Explanation: Option A '1; ls' is the correct answer. This payload attempts to terminate the current command and execute 'ls' to list directory contents, a common test for command injection vulnerabilities on Unix-based systems. Option B '1 OR 1=1' is an SQL injection payload, not relevant for command injection. Option C '1' UNION SELECT null --' is also related to SQL injection. Option D 'alert('test')' is a payload for testing cross-site scripting (XSS) vulnerabilities.

Correct Answer: B

Explanation: Option B is the correct answer because Burp Suite's Intruder tool is designed to automate the testing of web application parameters by sending multiple payloads to identify vulnerabilities like command injection. Repeater (Option A) is used for manual testing of requests. Decoder (Option C) is for encoding/decoding data, and Comparer (Option D) is for comparing responses, neither of which are suitable for automating injection tests.

Correct Answer: C

Explanation: Outdated software configurations can lead to an increased likelihood of Command Injection attacks if known vulnerabilities in older versions are not patched. While outdated software can also contribute to other risks, like unauthorized data exposure (Option D) or DoS (Option B), it specifically makes the application more susceptible to known vulnerabilities, including command injection. Option A is less directly related to outdated configurations.

Correct Answer: C

Explanation: Option C 'Implement strict input validation and whitelisting' is the correct answer. Whitelisting ensures that only expected and safe inputs are allowed, effectively mitigating command injection risks. Option A 'Sanitize user input by removing all special characters' is not sufficient as attackers may find ways around it. Option B 'Use parameterized queries and prepared statements' is effective for SQL injection, not command injection. Option D 'Log all user inputs for later analysis' is useful for auditing but does not prevent the vulnerability.

Correct Answer: B

Explanation: Option B is the correct answer because the exposure of sensitive information such as a database password in a configuration file represents a Sensitive Data Exposure vulnerability. Option A, Command Injection, involves executing arbitrary commands on the host. Option C, Cross-Site Scripting, involves injecting scripts into web pages. Option D, SQL Injection, involves manipulating SQL queries. None of these apply to the exposure of sensitive data in configuration files.

Correct Answer: B

Explanation: Metasploit is a powerful tool that can be used to automate the exploitation of vulnerabilities, including command injection, and can help in setting up a reverse shell. Burp Suite (A) is primarily used for intercepting and modifying HTTP requests. SQLMap (C) is specialized for SQL injection, not command injection. OWASP ZAP (D) is similar to Burp Suite, focusing on web application security testing but doesn't specialize in automating command injection exploitation.

Correct Answer: C

Explanation: Option C is correct because the response shows that the server executed the command 'ls -la', indicating a command injection vulnerability. Option A is incorrect as SQL Injection involves database queries, not OS commands. Option B is incorrect because XSS targets client-side scripts, not server-side command execution. Option D is incorrect as IDOR involves unauthorized access to objects, not command execution.

Correct Answer: B

Explanation: Option B is correct because a comprehensive report should include a detailed proof of concept to demonstrate the vulnerability and provide remediation recommendations to help the client fix the issue. Option A is incorrect because technical details alone are insufficient for a complete report. Option C is incorrect because providing a proof of concept is important for demonstrating the issue, and legal concerns can be addressed through proper authorization. Option D is incorrect because suggesting remediation steps is crucial for helping the client address the vulnerability.

Correct Answer: B

Explanation: Option B is the correct answer because uploading a PHP shell with a .jpg extension exploits the lack of file type validation and can lead to remote code execution if the server executes the file. Option A (uploading a large image) might cause a denial of service but does not exploit the file type misconfiguration directly. Option C (malicious EXIF data) is less likely to be executed unless the application processes EXIF data insecurely. Option D (uploading a text file with SQL commands) is not applicable as it doesn't exploit the file upload functionality.

Correct Answer: C

Explanation: Option C 'Scanner' is the correct answer. Burp Suite's Scanner is designed to automatically detect vulnerabilities, including command injection, by sending various payloads and analyzing the responses. Option A 'Intruder' is used for customized attacks and brute force testing. Option B 'Repeater' is for manual testing of requests. Option D 'Decoder' is used for encoding and decoding data.