Offensive Security Prep Pack for eJPT, OSCP, PNPT, OSWE, and OSEP— Practice Questions: Web Application Exploitation Domain

You are testing a Node.js/Express application that exposes a JSON-based login API:

// app.js
app.post('/api/login', async (req, res) => {
  const { username, password } = req.body;

  if (!username || !password) {
    return res.status(400).json({ error: 'Missing credentials' });
  }

  const user = await db.users.findOne({ username: username });
  if (!user) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }

  // Passwords are stored as bcrypt hashes
  const ok = await bcrypt.compare(password, user.password);
  if (!ok) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }

  return res.json({ token: signJwt({ id: user._id, role: user.role }) });
});

The db.users.findOne function is a thin wrapper around the MongoDB Node.js driver:

// db.js
exports.users = {
  findOne: async (query) => {
    return await client.db('app').collection('users').findOne(query);
  }
};

You notice that the application uses body-parser with extended: true, and that it does not perform any type checking on username. Which of the following payloads is most likely to allow you to bypass authentication and log in as an arbitrary user without knowing their password?

const user = await db.users.findOne({ username: username });

{ "username": { "$ne": null } }

You are performing a white-box assessment of a PHP-based bug tracking system. The application allows project managers to upload a project logo. You find the following code in upload_logo.php:

<?php
session_start();
require_once 'auth.php';
require_once 'db.php';

if (!isProjectManager($_SESSION['user_id'], $_POST['project_id'])) {
    http_response_code(403);
    die('Forbidden');
}

if (!isset($_FILES['logo']) || $_FILES['logo']['error'] !== UPLOAD_ERR_OK) {
    die('Upload error');
}

$allowed = ['image/png', 'image/jpeg'];
if (!in_array($_FILES['logo']['type'], $allowed, true)) {
    die('Invalid file type');
}

$ext = pathinfo($_FILES['logo']['name'], PATHINFO_EXTENSION);
$filename = 'logo_' . intval($_POST['project_id']) . '.' . $ext;
$target = __DIR__ . '/uploads/' . $filename;

if (!move_uploaded_file($_FILES['logo']['tmp_name'], $target)) {
    die('Failed to move file');
}

$stmt = $db->prepare('UPDATE projects SET logo_path = ? WHERE id = ?');
$stmt->execute(['/uploads/' . $filename, $_POST['project_id']]);

header('Location: project.php?id=' . intval($_POST['project_id']));

In project.php you see:

<?php
$project_id = intval($_GET['id']);
$stmt = $db->prepare('SELECT name, logo_path FROM projects WHERE id = ?');
$stmt->execute([$project_id]);
$project = $stmt->fetch(PDO::FETCH_ASSOC);

if ($project && $project['logo_path']) {
    echo '<img src="' . htmlspecialchars($project['logo_path'], ENT_QUOTES, 'UTF-8') . '" alt="Logo">';
}

Apache configuration includes:

<Directory /var/www/html/uploads>
    Options -Indexes +ExecCGI
    AddHandler application/x-httpd-php .php .phtml
    AllowOverride None
    Require all granted
</Directory>

You have a valid low-privileged account and can create a project where you are the project manager. You want RCE. Which strategy is the most realistic and effective given the code and configuration?

You are reviewing a Java DAO method:

public Product getProductById(String id) throws SQLException {
    String sql = "SELECT id, name, price, description FROM products WHERE id = " + id;
    Statement stmt = conn.createStatement();
    ResultSet rs = stmt.executeQuery(sql);

    if (rs.next()) {
        Product p = new Product();
        p.setId(rs.getInt("id"));
        p.setName(rs.getString("name"));
        p.setPrice(rs.getBigDecimal("price"));
        p.setDescription(rs.getString("description"));
        return p;
    }
    return null;
}

Controller:

@GetMapping("/product")
public String product(@RequestParam("id") String id, Model model) {
    Product p = productDao.getProductById(id);
    model.addAttribute("product", p);
    return "product";
}

DB user has SELECT/INSERT/UPDATE/DELETE on products only; no privileges on users. Which attack path is most realistic to reach an auth bypass given constraints?

Flask admin endpoint:

from flask import Flask, request, render_template_string, session, abort

app = Flask(__name__)
app.secret_key = 'super-secret-key'

@app.route('/admin/panel')
def admin_panel():
    if not session.get('is_admin'):
        abort(403)

    widget = request.args.get('widget', 'stats.html')

    template = '''
    {% include 'base.html' %}
    {% include 'widgets/' + widget %}
    '''

    return render_template_string(template, user=session.get('user'))

You can set session['is_admin'] = True via a weak cookie. You cannot upload files. Which payload in widget is most likely to yield RCE?

Login + JWT code:

// LoginServlet.java (excerpt)
String token = JwtUtil.sign(user.getId(), user.getRole());
Cookie c = new Cookie("auth", token);
c.setHttpOnly(true);
c.setPath("/");
resp.addCookie(c);

// JwtUtil.java (excerpt)
private static final String SECRET = "dev-secret";

public static String sign(int userId, String role) {
    Algorithm alg = Algorithm.HMAC256(SECRET);
    return JWT.create()
            .withClaim("uid", userId)
            .withClaim("role", role)
            .sign(alg);
}

A unit test exists and is deployed with the app:

// JwtUtilTest.java (excerpt)
@Test
public void testSign() {
    String token = JwtUtil.sign(1, "admin");
    System.out.println(token);
}

Which is the most realistic way to gain admin access to /account without valid credentials?

Search helper concatenates ORDER BY:

async function searchProducts(term, orderBy) {
  const sql = `
    SELECT id, name, price
    FROM products
    WHERE name LIKE ?
    ORDER BY ${orderBy} ASC
    LIMIT 20
  `;
  return pool.query(sql, [`%${term}%`]);
}

Caller whitelists sort:

const orderBy = req.query.sort || 'name';

if (!['name', 'price'].includes(orderBy)) {
  orderBy = 'name';
}

Which approach is most accurate and realistic from an OSWE perspective?

Password reset route:

const payload = jwt.verify(token, process.env.JWT_SECRET || 'dev-secret');

Staging leaks: [DEBUG] Using default JWT secret. You want to escalate to admin@example.com. Which approach is most reliable?

Coupon controller:

String sql = "SELECT * FROM coupons WHERE code = '" + code + "'";
Coupon coupon = jdbcTemplate.queryForObject(sql, new CouponRowMapper());

Errors not shown to user; you can measure timing and see logs. Most reliable exfil approach?

Download handler:

$baseDir = __DIR__ . '/uploads/' . $ticketId . '/';
$path = realpath($baseDir . $file);

if ($path === false || strpos($path, $baseDir) !== 0) {
    http_response_code(400);
    exit('Invalid file');
}

You want to read /var/log/nginx/access.log without uploading new files. Which approach is most likely?

DAO uses PreparedStatement for status and whitelists sort:

// Whitelist for sort column
if (!sort.matches("^[a-z_]+$") ||
    !(sort.equals("created_at") || sort.equals("priority") || sort.equals("id"))) {
    sort = "created_at";
}

String sql = "SELECT id, title, status, owner_id FROM tickets WHERE status = ? ORDER BY " + sort;

PreparedStatement ps = conn.prepareStatement(sql);
ps.setString(1, status);

Which is the most realistic and effective way to achieve time-based blind SQLi under default PostgreSQL behavior?