Common web application vulnerabilities and attack techniques tested on the CompTIA PenTest+ exam.
35 cards · basic cards · AI-written, checked twice. Edit anything.
- What is SQL injection and how does it work?
Show answer
SQL injection is an attack where attacker input is inserted into a SQL query, allowing unauthorized database access, modification, or deletion when user input is not properly sanitized.- What is a union-based SQL injection attack?
Show answer
A technique that uses the UNION operator to append attacker-controlled query results to legitimate query results, revealing database structure and data.- How does time-based blind SQL injection work?
Show answer
The attacker injects conditional sleep commands; if the condition is true, the database delays its response, allowing attackers to infer true/false conditions without error messages.- What is error-based SQL injection?
Show answer
An attack that deliberately triggers SQL errors to extract database information, using EXTRACTVALUE, UpdateXML, or syntax errors to leak data through error messages.- What is reflected XSS?
Show answer
A cross-site scripting attack where malicious script is reflected in the HTTP response to the user's browser immediately, without being stored on the server.- What is stored XSS?
Show answer
A cross-site scripting attack where malicious script is stored on the server and executed in every user's browser when they view the affected page.- What is DOM-based XSS?
Show answer
A client-side XSS attack where vulnerable JavaScript code processes user input and modifies the DOM without sanitization, executing injected script in the browser.- What is cross-site request forgery and how does it work?
Show answer
CSRF is an attack where a victim performs unwanted actions on another site where they are authenticated, by tricking them into clicking a malicious link or loading a page.- What is a session fixation attack?
Show answer
An attacker forces a victim to use a known session ID, then hijacks the session after the victim authenticates with that ID.- What is credential stuffing?
Show answer
An attack where compromised username and password pairs from one breach are tested against other sites, exploiting password reuse.- What is an insecure direct object reference (IDOR)?
Show answer
A vulnerability where users can access other users' resources by modifying object identifiers in requests, due to missing access control checks.- What is horizontal privilege escalation?
Show answer
An attack where a user accesses resources or functions of another user at the same privilege level, usually by modifying user identifiers or IDs.- What is vertical privilege escalation?
Show answer
An attack where a lower-privileged user gains higher privilege access, such as a regular user becoming an administrator.- What is an XXE (XML External Entity) attack?
Show answer
An XML parser processes external entity definitions, allowing attackers to read local files, access internal services, or cause denial of service.- How can XXE be used to achieve remote code execution?
Show answer
By exploiting a vulnerable XML parser to access expect:// or php:// wrappers on systems that support them, executing arbitrary commands.
FlashKeepers