Web App Testing

Question 1

A parameter file=report.pdf returns files. Changing to ../../../../etc/passwd returns 500. Best next step?

Answer 1

Try traversal encodings and validate path handling safely; check error messages and app language.

Question 2

LFI suspected. You can read /etc/passwd. What’s the safest next objective?

Answer 2

Confirm controlled file read, then look for log/config files that enable code execution only if allowed.

Question 3

Upload form accepts images only. You can upload .php but it’s renamed. Next step?

Answer 3

Test storage location, execution prevention, and whether double extensions/content-type checks can be bypassed safely.

Question 4

Login endpoint returns different error for valid users. What finding is this and what’s next?

Answer 4

User enumeration; document and then test auth protections (lockout/MFA) carefully.

Question 5

You see id in a REST API path /api/orders/123. Changing ID returns another user’s order. What is this?

Answer 5

IDOR/broken access control; document impact with minimal sensitive data exposure.

Question 6

A search box shows SQL errors when you enter '. What’s your next step?

Answer 6

Determine injection context and test minimally for UNION/error/blind behavior; aim for safe proof.

Question 7

Blind SQLi suspected (no errors). What evidence can you use?

Answer 7

Boolean/time-based behavior differences (controlled delays) with minimal requests.

Question 8

App reflects input in HTML. You suspect XSS. What’s safe OSCP proof?

Answer 8

Show harmless script execution (e.g., alert) in your own session and document affected parameter/page.

Question 9

A URL fetch feature requests arbitrary URLs. You suspect SSRF. Safest test?

Answer 9

Request a harmless internal endpoint/metadata without extracting secrets; document reachable scope.

Question 10

You can execute ping via a command injection. What’s next?

Answer 10

Try minimal command execution proof and then aim for a stable shell only if allowed and safe.

Question 11

Directory traversal lets you read app config that contains DB creds. What should you do?

Answer 11

Use creds to authenticate to DB/app as needed and document chain; minimize data access.

Question 12

You found a JWT in localStorage with long expiry. What risk and next test?

Answer 12

Token theft equals prolonged access; test signature/alg settings only if authorized; recommend rotation/shorter TTL.

Question 13

Web app behind reverse proxy shows X-Forwarded-For handling. What security test matters?

Answer 13

Check for auth bypass/IP-trust misconfig (e.g., admin access by spoofed headers).