Common web application vulnerabilities and attack techniques tested on the CompTIA PenTest+ exam.
35 cards · basic cards · AI-written, checked twice. Edit anything.
- What is SQL injection and how does it work?
- SQL injection is an attack where attacker input is inserted into a SQL query, allowing unauthorized database access, modification, or deletion when user input is not properly sanitized.
- What is a union-based SQL injection attack?
- A technique that uses the UNION operator to append attacker-controlled query results to legitimate query results, revealing database structure and data.
- How does time-based blind SQL injection work?
- The attacker injects conditional sleep commands; if the condition is true, the database delays its response, allowing attackers to infer true/false conditions without error messages.
- What is error-based SQL injection?
- An attack that deliberately triggers SQL errors to extract database information, using EXTRACTVALUE, UpdateXML, or syntax errors to leak data through error messages.
- What is reflected XSS?
- A cross-site scripting attack where malicious script is reflected in the HTTP response to the user's browser immediately, without being stored on the server.
- What is stored XSS?
- A cross-site scripting attack where malicious script is stored on the server and executed in every user's browser when they view the affected page.
- What is DOM-based XSS?
- A client-side XSS attack where vulnerable JavaScript code processes user input and modifies the DOM without sanitization, executing injected script in the browser.
- What is cross-site request forgery and how does it work?
- CSRF is an attack where a victim performs unwanted actions on another site where they are authenticated, by tricking them into clicking a malicious link or loading a page.
- What is a session fixation attack?
- An attacker forces a victim to use a known session ID, then hijacks the session after the victim authenticates with that ID.
- What is credential stuffing?
- An attack where compromised username and password pairs from one breach are tested against other sites, exploiting password reuse.
- What is an insecure direct object reference (IDOR)?
- A vulnerability where users can access other users' resources by modifying object identifiers in requests, due to missing access control checks.
- What is horizontal privilege escalation?
- An attack where a user accesses resources or functions of another user at the same privilege level, usually by modifying user identifiers or IDs.
- What is vertical privilege escalation?
- An attack where a lower-privileged user gains higher privilege access, such as a regular user becoming an administrator.
- What is an XXE (XML External Entity) attack?
- An XML parser processes external entity definitions, allowing attackers to read local files, access internal services, or cause denial of service.
- How can XXE be used to achieve remote code execution?
- By exploiting a vulnerable XML parser to access expect:// or php:// wrappers on systems that support them, executing arbitrary commands.
FlashKeepers