Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Hacking > Situational Web > Flashcards

Situational Web Flashcards

(59 cards)

Start Studying
1
Q

What can you do if you want to find the language running on the back end?

A

Fuzz the file extension of index like index.FUZZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What vulnerabilities to look for in an exposed login page?

A

SQL Injection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What tool to use for brute-forcing login credentials?

A

Hydra

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What tool to use to test for SQL injection?

A

sqlmap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What attack to test when you find an exposed API?

A

Broken Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How to identify an IDOR vulnerability?

A

Modify parameters in requests (e.g.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What tool to use for finding exposed sensitive files?

A

dirb

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What headers should be checked for security misconfigurations?

A

CSP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What tool to use for testing Cross-Site Scripting (XSS)?

A

XSSHunter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How to check if a website is vulnerable to CORS misconfiguration?

A

Test Access-Control-Allow-Origin headers with malicious origins

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What attack can be performed with unrestricted file upload?

A

Remote Code Execution (RCE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What tool to use for testing for Server-Side Request Forgery (SSRF)?

A

Burp Collaborator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How to check for weak JWT signing keys?

A

Use jwt_tool or CrackJWT to brute-force signing key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What attack can be performed with insecure JWT algorithms?

A

Switch algorithm from RS256 to None to bypass authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What tool to use to enumerate subdomains?

A

Subfinder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What attack can be performed with a vulnerable deserialization function?

A

Remote Code Execution (RCE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What tool to use for testing XML External Entity (XXE) vulnerabilities?

A

Burp Suite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How to identify and exploit a Host Header attack?

A

Modify Host header to bypass authentication or perform cache poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What attack to test when you find an admin panel?

A

Brute-force login

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What tool to use for testing CSRF vulnerabilities?

A

Burp Suite CSRF PoC generator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What vulnerabilities to test for in a GraphQL API?

A

Insecure Direct Object Reference (IDOR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What attack can be performed with a NoSQL Injection vulnerability?

A

Authentication Bypass

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How to check for rate limiting issues?

A

Send multiple requests rapidly and observe response behavior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What tool to use for checking misconfigured S3 buckets?

25
How to bypass WAF protections?
Encode payloads
26
What attack can be performed with improper session management?
Session Fixation
27
How to check for hardcoded secrets in JavaScript files?
Review source code manually
28
What vulnerabilities to test for in an OAuth implementation?
Token Reuse
29
What tool to use for discovering web technologies?
Wappalyzer
30
What attack can be performed with a misconfigured CORS policy?
Stealing authentication tokens
31
How to find hidden endpoints in a web application?
Analyze JavaScript files
32
What vulnerabilities to test for in a file download feature?
Path Traversal
33
What tool to use for discovering vulnerable WordPress plugins?
WPScan
34
What attack can be performed with a vulnerable redirect endpoint?
Open Redirect
35
How to test for weak password policies?
Use common password lists with Hydra or Burp Intruder
36
What tool to use for analyzing web socket security?
Burp Suite
37
How to identify if a site is vulnerable to Clickjacking?
Check for missing X-Frame-Options header and use an iframe to embed the page
38
What attack can be performed with an unrestricted GraphQL query?
Data Over-Extraction
39
What tool to use for detecting CVEs in web applications?
Nuclei
40
How to exploit a SSTI (Server-Side Template Injection) vulnerability?
Inject template payloads like {{7*7}}
41
What tool to use for detecting JavaScript security issues?
Retire.js
42
How to exploit weak object-level authorization in an API?
Modify resource IDs in API requests and check unauthorized access
43
What tool to use for checking for CVEs in third-party libraries?
Dependency-Check
44
How to bypass a login page using SQL Injection?
Use payloads like ' OR 1=1 --
45
What vulnerabilities to test for in a multi-factor authentication system?
2FA Bypass via Response Manipulation
46
How to detect web cache poisoning vulnerabilities?
Modify request headers (X-Forwarded-Host
47
What attack can be performed with an open .git directory?
Source Code Disclosure
48
What tool to use for finding secrets in leaked repositories?
TruffleHog
49
What kind of PHP input sanitization is good for viewing source code?
Appended extensions (appending a .php)
50
What are some sanitization methods to keep in mind when exploiting LFI?
Appended Extensions, Filename Prefix, Removing .., Approved Paths
50
How can you bypass Appended Extension sanitization PHP LFI?
Truncation Bypass, Null Byte Injection, convert.base64-encode filter
51
What do you need to make truncation bypas work for LFI?
< PHP 5.3/5.4 and payload prefixed with non-existant directory
52
What version of PHP does Null byte injection bypass work for LFI?
< PHP 5.5
53
How can we bypass filename prefix santitization PHP LFI?
sometimes by prefixing payload with / character (only if there is a directory with the prefix name)
54
How to bypass .. removal sanitization PHP LFI?
using ....// and ..././ payloads
55
How to bypass approved paths sanitization php
begin path with approved directory (if approved files in languages/ directory begin payload with ./languages/ or languages/)
56
How can you tell if a server side include function is capable of executing PHP code?
Include a PHP code and see if the plain source or a generated page comes back.
57
What is a .net web shell?
<% eval request('cmd') %>
59
HTML forms parameters are normally well tested. How can you exploit other parameters.
Identify parameters not used in forms and fuzz for parameters

Hacking (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions