Web Application Penetration Testing

CPTS · 60 questions

• A city web engagement begins by placing an intercepting proxy in the browser path. What is the primary reason that step matters?
• A county thick-client application speaks HTTP to backend APIs. How should proxy skills apply?
• A municipal web app uses certificate pinning that breaks the tester’s TLS interception. What is the sound methodological response?
• A library tester needs to vary a single request parameter while keeping the rest of a captured HTTP call intact. Which approach best matches controlled testing judgment?
• A transit content-discovery pass will use Ffuf-class tooling against a civic CMS. What discovery practice should guide the run?
• A city API exposes predictable paths such as /v1/user/{id}. Beyond listing HTML pages, what should discovery planning emphasize?
• A county web login form will be tested with carefully limited credential attempts under the rules of engagement. What constraint remains non-negotiable?
• A municipal app reflects user input into HTML responses without encoding. How should the tester classify the primary risk theme?
• A library comment field stores script that later runs in an administrator’s browser. Which XSS class best describes that pattern?
• A transit portal builds page behavior from untrusted URL fragments that flow into DOM sinks. What XSS theme does that illustrate?
• A city session cookie is missing the HttpOnly flag. In an XSS discussion, why does that matter?
• A county search box returns database-flavored errors that suggest SQL injection. What should the tester do before any broad automated dumping?
• A municipal app shows no verbose SQL errors, yet responses consistently change between true-looking and false-looking conditions for crafted inputs. How should that theme be classified?
• A library stakeholder wants SQLMap run against production with full crawl and unrestricted dump options. What automation judgment should the tester apply?
• A transit UNION-based SQL injection could return citizen PII. How should the tester demonstrate impact responsibly?
• A city portal stores a citizen nickname that is later reused in a different admin report query. Injection fails on the registration request but succeeds when staff generate that report. What injection class best fits this pattern?
• A county download endpoint accepts a file path parameter and returns document contents with little sanitization. What vulnerability class should the tester prioritize investigating?
• A municipal template engine includes remote URLs supplied by users when rendering pages. What risk class should the tester flag?
• A library upload form rejects filenames ending in .php but accepts the same script contents when renamed with an image extension and a matching Content-Type. What validation weakness does this demonstrate?
• A transit portal stores user uploads under a web-accessible directory where the server will execute matching scripts. Why is this combination a critical finding class?
• A city blocks a short list of dangerous extensions but does not normalize case, double extensions, or alternate handlers. What is the sound assessment takeaway?
• A county ticket system passes unsanitized user fields into a shell command that generates PDFs. Which vulnerability class does this describe?
• A municipal filter strips semicolon characters from PDF-job inputs but still shells out to build the command. What is the correct conceptual judgment?
• A library PDF feature never echoes command output, but carefully timed requests show consistent delays that track injected sleep-style behavior under RoE. What detection concept applies?
• A transit admin delete action is blocked on POST but succeeds when the same URL is requested with PUT or DELETE. What attack class does this illustrate?
• A city citizen portal shows another resident's case details when only the case ID in the URL is changed. What vulnerability class is this?
• A county intake form accepts XML uploads and the parser resolves external entities. What risk class should the tester report?
• A municipal API accepts a hidden role field from the client JSON body and grants admin features when it is set. What flaw theme should the tester call out?
• A library account settings page changes email via session-cookie authenticated POST with no anti-CSRF token or equivalent defense. What vulnerability class fits?
• A transit operations admin console uses HTTP Basic authentication over plain HTTP on an internal VLAN. How should the tester treat this?
• A city public CMS is years behind on patches and still serves the default administrator path. What hygiene finding theme is most accurate?
• A county continuous-integration portal similar to Jenkins is reachable from the internet with weak password-only auth. How should the tester prioritize it?
• A municipal database administration UI similar to phpMyAdmin is reachable without MFA and with broad network access. What is the correct finding emphasis?
• A library multi-tenant SSO setup lets a user from one tenant open another tenant's account context after a misconfigured identity mapping. What theme should the tester frame?
• A transit password-reset endpoint accepts unlimited attempts and returns distinct messages for valid versus invalid accounts. What abuse class should the tester highlight?
• A city GraphQL API leaves introspection enabled in production, revealing the full schema to unauthenticated clients. What is the tester's best framing?
• A county API verifies JWTs poorly, including accepting tokens that declare insecure algorithm handling. What vulnerability class theme applies?
• A municipal API reflects arbitrary Origin values in Access-Control-Allow-Origin while also allowing credentials. Why is this dangerous?
• A library feature fetches a user-supplied URL from the application server to generate link previews. What vulnerability class should the tester investigate first?
• A transit download response places an unsanitized user-controlled filename into Content-Disposition and related headers. What issue class should the tester emphasize?
• A city portal caches authenticated resident pages on a shared CDN edge. During a web assessment, what risk should the tester prioritize documenting?
• A county RoE excludes the HR admin panel, but an abandoned CNAME for a decommissioned ticket portal remains in scope. What should the tester do?
• A municipal chat feature uses WebSockets for permit-status actions. What authorization concern should the tester apply?
• A library voucher system is meant to redeem each code once, but simultaneous requests appear to redeem the same voucher twice. What finding class does this illustrate?
• A transit multi-step checkout accepts the price totals submitted from the browser on step 3. What should the tester emphasize?
• A city WAF blocks several obvious SQLi probe strings during testing. What is the most appropriate next methodology choice?
• A county security lead wants only automated DAST and no manual web testing for a civic portal. What should the tester explain?
• A municipal API returns stack traces that include resident email addresses in error bodies. How should the tester classify this?
• A library application behaves differently when the same parameter name appears twice in a request and authorization checks flip unexpectedly. What technique class is the tester observing?
• A transit portal redirects users to any URL supplied in a next= parameter without allowlisting. Why is this still a meaningful finding for civic staff phishing risk?
• A city payroll approval page can be framed by a third-party origin and overlays the Approve button. What defensive gap does this primarily indicate?
• A county GraphQL endpoint applies a per-HTTP-request rate limit, yet a single request can batch many aliased operations. What control gap should the tester highlight?
• A municipal upload feature re-encodes images but still stores files under a web-accessible path with predictable names. What defense-in-depth guidance fits best?
• A library XSS finding only triggers in an obsolete browser feature few patrons still use. How should the tester frame impact?
• A transit application accepts serialized objects from untrusted clients and reconstructs them server-side. What class of risk should the tester emphasize without providing exploit recipes?
• A city admin portal keeps the same session identifier after a user elevates from read-only staff to full administrator. What session hygiene issue should the tester flag?
• A county account settings page lets an already authenticated user change the password without re-entering the current password or completing step-up MFA. Why is this a problem if a session was stolen?
• A municipal web app has no Content-Security-Policy, or leaves CSP in report-only mode indefinitely. How should the tester describe CSP's role?
• A library admin UI ships a years-outdated JavaScript library known for client-side vulnerability classes. What should the tester emphasize?
• A transit engagement identifies server-side request forgery that can reach cloud instance metadata endpoints. How should impact be framed without exploit steps?