Pentest App Quiz: Can You Master SQLi, XSS & XXE?

1. Which attack involves modifying a URL parameter to inject code? Example: `site.com/page?id=alert(1)`

Reflected XSS

CSRF attack

SQL injection

XXE injection

2. An XML parser receives: `]>` What attack is this?

Billion laughs denial of service attack

XXE file disclosure

XML injection

Entity reference overflow

3. What does input sanitization accomplish in web security?

Removes or encodes potentially dangerous characters from user input

Encrypts all user data before storage

Prevents network packet loss

Blocks all external API calls

4. Which code pattern is most vulnerable to command injection?

System(userInput)

ParseInt(userInput)

Strlen(userInput)

Trim(userInput)

5. An attacker sends a request to a bank website while you are logged in, causing an unauthorized transfer. What attack is this?

Cross-Site Request Forgery (CSRF)

Session hijacking

Man-in-the-middle attack

Credential stuffing

6. Which OWASP Top 10 category includes SQL injection and XSS attacks?

A03:2021 – Injection

A01:2021 – Broken Access Control

A05:2021 – Broken Access Control

A07:2021 – Identification and Authentication Failures

7. An application accepts file uploads without validation. An attacker uploads a PHP shell. What vulnerability allows code execution?

Unrestricted file upload

Broken authentication

Insecure deserialization

Path traversal

8. What is the primary risk of an unvalidated redirect vulnerability?

Redirecting users to malicious sites for phishing

Corrupting the database

Exposing source code

Disabling user authentication

9. Which of the following is NOT a common web application attack vector?

Firmware modification

SQL injection

Cross-site scripting

XML external entity injection

10. A web form accepts user input and stores it in a database without sanitization. Later, the data displays on other users' pages. What vulnerability is this?

Stored XSS

Reflected XSS

LDAP injection

Command injection

11. Which of the following best describes SQL injection (SQLi)?

Inserting malicious SQL code into input fields to manipulate database queries

Blocking database connections with distributed requests

Encrypting database communications to prevent eavesdropping

Monitoring database logs for suspicious activity

12. How can developers prevent XXE attacks?

Disable external entity processing in XML parsers

Use HTTPS for all XML transmissions

Implement rate limiting on XML endpoints

Validate XML file size

13. An XML parser processes this input: `` What attack is occurring?

XXE leading to file disclosure

SQL injection through XML

Cross-site request forgery

Denial of service via malformed XML

14. What is XXE (XML External Entity) injection?

Exploiting XML parsers by injecting malicious external entity definitions

Blocking XML requests from untrusted sources

Encrypting XML data in transit

Validating XML schema compliance

15. Which HTTP header can help mitigate XSS attacks?

Content-Security-Policy

Accept-Encoding

Cache-Control

Set-Cookie

16. A website displays user comments without sanitization. An attacker posts: `alert('XSS')` Which type of XSS is this?

Stored XSS

Reflected XSS

DOM-based XSS

Server-side XSS

17. What does XSS (Cross-Site Scripting) allow an attacker to do?

Inject and execute malicious scripts in a victim's browser

Directly modify database records

Bypass SSL/TLS encryption

Crash the web server

18. Which parameterized query approach BEST prevents SQL injection?

Using prepared statements with placeholders

Filtering input with regular expressions

Encoding special characters in strings

Logging all database queries

19. A developer uses the following code: `String query = "SELECT * FROM users WHERE id=" + userId;` What vulnerability exists?

SQL injection due to unparameterized query

Cross-site scripting in the database layer

Buffer overflow in string concatenation

XML parsing error

Pentest App Quiz: Can You Master SQLi, XSS & XXE?

1. Which attack involves modifying a URL parameter to inject code? Example: `site.com/page?id=alert(1)`

2.

What first name or nickname would you like us to use?

2. An XML parser receives: `]>` What attack is this?

3. What does input sanitization accomplish in web security?

4. Which code pattern is most vulnerable to command injection?

5. An attacker sends a request to a bank website while you are logged in, causing an unauthorized transfer. What attack is this?

6. Which OWASP Top 10 category includes SQL injection and XSS attacks?

7. An application accepts file uploads without validation. An attacker uploads a PHP shell. What vulnerability allows code execution?

8. What is the primary risk of an unvalidated redirect vulnerability?

9. Which of the following is NOT a common web application attack vector?

10. A web form accepts user input and stores it in a database without sanitization. Later, the data displays on other users' pages. What vulnerability is this?

11. Which of the following best describes SQL injection (SQLi)?

12. How can developers prevent XXE attacks?

13. An XML parser processes this input: `` What attack is occurring?

14. What is XXE (XML External Entity) injection?

15. Which HTTP header can help mitigate XSS attacks?

16. A website displays user comments without sanitization. An attacker posts: `alert('XSS')` Which type of XSS is this?

17. What does XSS (Cross-Site Scripting) allow an attacker to do?

18. Which parameterized query approach BEST prevents SQL injection?

19. A developer uses the following code: `String query = "SELECT * FROM users WHERE id=" + userId;` What vulnerability exists?