Application Attacks

Question 1 of 6

An attacker enters admin' -- into a login form's username field with any value in the password field. How does this input bypass authentication?

A. The double-dash sequence triggers a default failover path in the database engine that returns the first user record when query syntax is malformed B. The input is hashed before reaching the database, and the hash of admin' -- happens to match the stored admin password hash C. The single quote closes the username string literal in the SQL query; the double-dash begins a SQL comment that discards everything following it — including the entire password check; the query returns the admin record and login succeeds with no password verification D. The query fails with a syntax error and the application defaults to granting access to avoid locking out administrators during database errors

Question 2 of 6

An attacker attempts a buffer overflow but supplies random data without knowing the target application's memory layout. What is the most likely outcome?

A. Arbitrary code execution — modern CPUs recognize buffer overflow conditions and automatically redirect excess data to a reserved shellcode execution region B. Application crash — the return address is overwritten with random garbage; when the function ends, the CPU attempts to jump to a nonsensical address and the OS terminates the process with a segmentation fault C. A benign no-operation — modern operating systems automatically discard memory writes beyond the allocated buffer boundary without affecting adjacent memory regions D. ASLR activates and re-randomizes the entire process memory layout in response to the detected overflow, preventing adjacent memory from being affected

Question 3 of 6

CVE-2023-29336 is a vulnerability in the Win32k kernel driver. An attacker who already has a low-privilege user shell on an affected machine exploits it. What does this exploitation achieve?

A. Remote code execution on other machines reachable on the local network, allowing lateral movement without additional credentials B. SYSTEM-level privileges on the local machine — converting the low-privilege user shell into a SYSTEM shell with unrestricted access to every file, process, and account on that machine C. Read access to the domain controller's Active Directory database, allowing offline password cracking of all domain accounts D. Persistence across reboots by injecting a service into the Windows startup sequence that anti-malware cannot detect

Question 4 of 6

A web application processes fund transfers. A logged-in user clicks a link in a phishing email; the link causes their browser to silently submit a transfer to the attacker's account. The server processes it as legitimate. Which defense would have most directly prevented this outcome?

A. Enforcing HTTPS on the application — the transfer would have been rejected because the forged link used HTTP, which the server would refuse B. Setting the session cookie's HTTPOnly flag — this prevents JavaScript from reading the cookie, stopping the attacker from extracting and forwarding it C. Embedding a unique, unpredictable anti-CSRF token in every transfer form and validating it server-side on every state-changing request — the forged link arrives without a valid token and is rejected D. Requiring users to re-enter their password before any transfer — this verification step would have interrupted the forged request because the attacker cannot supply the victim's password

Question 5 of 6

A web server access log contains the entry: GET /view.php?page=../../../etc/passwd HTTP/1.1" 200. What does this entry indicate?

A. A normal successful request — the file etc/passwd is a legitimate document located three subdirectories below the application's content folder B. A successful directory traversal attack — the three ../ sequences navigated three levels above the web root; the HTTP 200 confirms the server served the Linux password file, meaning the application is vulnerable and the file was disclosed to the requester C. A failed attack — the HTTP 200 status code is the server's standard response for blocked directory traversal attempts, indicating the request was sanitized D. An IDOR attempt — the attacker is manipulating a numeric ID in the page parameter to access another user's records, which the server served successfully

Question 6 of 6

Why do parameterized queries prevent SQL injection architecturally, while input escaping and WAF filters are only considered secondary controls?

A. Parameterized queries hash user input before database submission, converting any SQL syntax into an unrecognizable hash string that the database cannot parse as commands B. Parameterized queries route database traffic through an application-layer firewall that strips SQL metacharacters before they reach the database engine, making injection impossible C. Parameterized queries send the query structure and user-supplied values to the database as completely separate elements; the engine always treats bound values as literal data regardless of content — SQL syntax in user input is interpreted as a string to search for, never as commands to execute D. Parameterized queries automatically escape SQL special characters by replacing apostrophes, semicolons, and comment operators with their safe equivalents before the query is assembled

Matching — Application Attack Types

Match each term on the left to its correct description on the right.

1. SQL Injection

2. Buffer Overflow

3. CSRF

4. Directory Traversal

A. Web application attack that exploits the browser's automatic session cookie inclusion — the attacker causes the victim's authenticated browser to submit state-changing requests to a trusted site without the user's knowledge or intent

B. Attack that inserts malicious commands into database queries through unsanitized application input fields, enabling authentication bypass, unauthorized data access, record modification, or table deletion

C. Attack that uses ../ sequences in URL parameters to navigate outside the web server's intended directory, allowing access to system files, configuration files, or credentials that are outside the web root

D. Vulnerability where a program writes more data to a fixed-size memory buffer than it can hold, potentially overwriting adjacent memory including the return address with attacker-controlled values to achieve arbitrary code execution

1 → 2 → 3 → 4 →

Application Attacks Quiz