GWAPT Practice Questions: Tools & Exploitation Frameworks Domain

Published: September 28, 2025 | 20 min read

Test your GWAPT knowledge with 10 practice questions from the Tools & Exploitation Frameworks domain. Includes detailed explanations and answers.

GWAPT Practice Questions

Master the Tools & Exploitation Frameworks Domain

Test your knowledge in the Tools & Exploitation Frameworks domain with these 10 practice questions. Each question is designed to help you prepare for the GWAPT certification exam with detailed explanations to reinforce your learning.

Question 1

During a web application penetration test, you discover a parameter that seems vulnerable to SQL injection. Which SQLMap option would you use to attempt a UNION-based SQL injection attack?

A) --dump

B) --union

C) --level=5

D) --technique=U

Show Answer & Explanation

Correct Answer: D

Explanation: The correct answer is --technique=U (D), which specifies that SQLMap should attempt UNION-based SQL injection techniques. --dump (A) is used to extract data from the database, --union (B) is not a valid option, and --level=5 (C) increases the level of tests, but does not specifically target UNION-based techniques.

Question 2

When using Burp Suite's Intruder tool to perform a password brute force attack on a web application's login form, which of the following configurations is crucial to ensure the attack is effective?

A) Selecting the 'Sniper' attack type to target multiple fields simultaneously.

B) Configuring the payload positions to include only the username field.

C) Using the 'Cluster Bomb' attack type to test combinations of usernames and passwords.

D) Ensuring the 'Grep - Match' option is set to identify successful login attempts.

Show Answer & Explanation

Correct Answer: C

Explanation: The 'Cluster Bomb' attack type in Burp Suite's Intruder allows you to test combinations of multiple payloads, which is essential for brute-forcing both username and password fields together. Option A is incorrect because the 'Sniper' attack type is used for single payload positions. Option B is incorrect because targeting only the username field would not test password combinations. Option D is incorrect because while 'Grep - Match' is useful, it alone does not ensure the effectiveness of the attack without proper attack type configuration.

Question 3

You are using SQLMap to exploit an SQL injection vulnerability in a web application. Which of the following commands would you use to enumerate the database users?

A) --dbs

B) --users

C) --tables

D) --columns

Show Answer & Explanation

Correct Answer: B

Explanation: The '--users' command in SQLMap is used to enumerate the database users. The '--dbs' option is for listing databases, '--tables' is for listing tables within a database, and '--columns' is for listing columns within a table. Therefore, to enumerate database users, '--users' is the correct option.

Question 4

You are examining the output of a Burp Suite scan and see the following alert: 'Reflected XSS vulnerability in parameter 'user''. Which action would you take next to manually verify this vulnerability?

A) Use Burp Repeater to send a request with a simple alert payload in the 'user' parameter.

B) Use Burp Intruder to brute force the 'user' parameter with various payloads.

C) Use Burp Decoder to decode the 'user' parameter value.

D) Use Burp Scanner to rescan the 'user' parameter with a higher level of intensity.

Show Answer & Explanation

Correct Answer: A

Explanation: To manually verify a reflected XSS vulnerability, you can use Burp Repeater to send a request with a simple JavaScript payload, such as an alert, in the 'user' parameter. This allows you to see if the payload is executed in the browser. Burp Intruder is more suited for automated attack payloads, Burp Decoder is for encoding/decoding, and rescanning with Burp Scanner may not provide manual verification.

Question 5

When using Burp Suite to intercept and modify HTTP requests, which feature allows you to automate the modification of requests based on specific patterns?

A) Repeater

B) Intruder

C) Proxy

D) Match and Replace

Show Answer & Explanation

Correct Answer: D

Explanation: The 'Match and Replace' feature in Burp Suite allows you to automate the modification of requests by specifying patterns to match and the replacement text. 'Repeater' is used for manual testing of requests, 'Intruder' is for automated customized attacks, and 'Proxy' is for intercepting and analyzing traffic.

Question 6

When using Burp Suite's Intruder tool to perform a password brute-force attack on a login page, which attack type would you select to test a list of usernames against a single password?

A) Sniper

B) Battering ram

C) Pitchfork

D) Cluster bomb

Show Answer & Explanation

Correct Answer: B

Explanation: The correct answer is B. The Battering ram attack type is used to test multiple payloads in the same position across multiple requests, which is suitable for testing a list of usernames against a single password. Sniper (A) tests one payload position at a time, Pitchfork (C) uses multiple payload sets in parallel, and Cluster bomb (D) tests combinations of multiple payloads across different positions.

Question 7

While performing a web application penetration test, you use Burp Suite's Intruder tool to test for SQL injection vulnerabilities. You receive the following HTTP response: 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near...'. What does this response indicate?

A) The application is using a NoSQL database, and the syntax error is irrelevant.

B) The SQL injection attempt was unsuccessful, and the application is secure.

C) The application is potentially vulnerable to SQL injection, as it is exposing database error messages.

D) The application is using parameterized queries, preventing SQL injection attacks.

Show Answer & Explanation

Correct Answer: C

Explanation: The presence of a database error message in the HTTP response suggests that the application is exposing internal error details, which is a common indicator of a potential SQL injection vulnerability. This exposure can provide valuable information to an attacker for crafting successful injection attacks. Option A is incorrect because the error message specifically mentions MySQL, indicating a SQL database. Option B is incorrect because the exposure of error messages is a security risk. Option D is incorrect because parameterized queries would typically prevent such error messages from being displayed.

Question 8

During a web application penetration test, you need to exploit a SQL injection vulnerability to extract database information. Which tool is best suited for automating this task and allows for easy database fingerprinting?

A) Burp Suite

B) OWASP ZAP

C) SQLMap

D) Nmap

Show Answer & Explanation

Correct Answer: C

Explanation: SQLMap is specifically designed for automating SQL injection exploitation and is highly effective for database fingerprinting and data extraction. Burp Suite and OWASP ZAP are primarily used for intercepting and manipulating web requests but do not specialize in SQL injection automation. Nmap is a network scanning tool and is not intended for web application SQL injection.

Question 9

You are using SQLMap to test a web application's login form for SQL injection vulnerabilities. After running SQLMap with the '--dump' option, you notice that it retrieves user data from the database. What does this indicate about the security of the application?

A) The application is not vulnerable to SQL injection since SQLMap could access the database.

B) The application is vulnerable to SQL injection, allowing unauthorized data extraction.

C) The application uses parameterized queries, which SQLMap can bypass.

D) The application is secure because SQLMap requires authentication to access data.

Show Answer & Explanation

Correct Answer: B

Explanation: The successful retrieval of user data using SQLMap's '--dump' option indicates that the application is vulnerable to SQL injection, as SQLMap was able to exploit the vulnerability to extract data from the database. Option A is incorrect because accessing the database in this context indicates a vulnerability. Option C is incorrect because parameterized queries should prevent SQL injection, not allow it. Option D is incorrect because the ability to dump data without proper authentication indicates a security flaw.

Question 10

While using Burp Suite to test a web application, you notice that the application is using JSON Web Tokens (JWT) for session management. Which tool would you use within Burp Suite to attempt to brute-force the token's secret key?

A) Repeater

B) Intruder

C) Decoder

D) Comparer

Show Answer & Explanation

Correct Answer: B

Explanation: Intruder is a tool within Burp Suite designed for automating customized attacks, such as brute-forcing. It is suitable for attempting to brute-force the secret key of a JWT by allowing you to configure payloads and attack patterns. Repeater is used for manually sending requests, Decoder is for encoding/decoding data, and Comparer is for comparing data. Therefore, Intruder is the correct choice for this task.

Ready to Accelerate Your GWAPT Preparation?

Join thousands of professionals who are advancing their careers through expert certification preparation with FlashGenius.

✅ Unlimited practice questions across all GWAPT domains
✅ Full-length exam simulations with real-time scoring
✅ AI-powered performance tracking and weak area identification
✅ Personalized study plans with adaptive learning
✅ Mobile-friendly platform for studying anywhere, anytime
✅ Expert explanations and study resources

Start Free Practice Now

Already have an account? Sign in here

About GWAPT Certification

The GWAPT certification validates your expertise in tools & exploitation frameworks and other critical domains. Our comprehensive practice questions are carefully crafted to mirror the actual exam experience and help you identify knowledge gaps before test day.

Practice Tests — Focused, timed, domain-based

Sharpen skills with domain-specific practice questions and timed exam simulations tailored for GWAPT on FlashGenius. Below pages have some sample questions

Tip: use the domain practice tests for targeted drilling and the cheat sheet for quick remediation notes after each mock.