Question 1

A healthcare portal blocks standard CSRF

Options :

A :

B :

C : Both A and B

D : Neither

Answer: C

Question 2

A server validates Host headers strictly to cdn.example.com. You want SSRF against localhost.

Which technique is MOST effective?

Options :

A : Use 127.0.0.1 directly

B : Use localhost.example.co

C : Use a DNS rebinding domain that resolves to 127.0.0.1 after initial validation

D : Use %2elocalhost encoding

Answer: C

Question 3

A user has sudoedit rights on /etc/exports via sudoedit /etc/exports.

How can you escalate to root?

Options :

A : Use sudoedit to add a line that gives root passwordless SSH access.

B : Use sudoedit to replace /etc/exports with a file that is parsed by a privileged process to execute commands (e.g., systemd or startup scripts).

C : Use sudoedit to replace /etc/exports with a file that is parsed by a privileged process to execute commands (e.g., systemd or startup scripts).

D : Use sudoedit to write a file in /etc/cron.d/ by using a symlink trick while the editor runs as root.

Answer: C

Question 4

You want to enumerate hidden admin panels on https://corp.example/ while avoiding common noise. Requirements:

Ignore responses with status codes 302 and 403.

Match only responses containing “Admin” or “Control Panel” (case-insensitive).

Randomize User-Agent each request from ua.txt.

Throttle requests to bypass rate-limiting.

Which ffuf command lines satisfy all requirements? (Select all that apply)

Options :

A : ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u https://corp.example/FUZZ \

-H "User-Agent: $(shuf -n1 ua.txt)" -fc 302,403 -mr "(?i)(Admin|Control Panel)" -p 0.2

B : ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u https://corp.example/FUZZ \

-H "User-Agent: Mozilla/5.0" -fc 403 -mr "Admin|Control Panel" -p 0.2

C : ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u https://corp.example/FUZZ \

-H "User-Agent: $(shuf -n1 ua.txt)" -fc 302,403 -mr "(?i)(Admin|Control Panel)" -p 0.3

D : ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u https://corp.example/FUZZ \

-H "User-Agent: fuzz" -fc 302,403 -mr "Admin" -t 50

E : ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u https://corp.example/FUZZ \

-H "User-Agent: $(shuf -n1 ua.txt)" -fc 302,403 -mr "(?i)(Admin|Control Panel)" -t 100

Answer: C

Question 5

A WAF blocks single quotes '. Which payload bypasses it to fetch database()?

Options :

A : 0x61646d696e AND database()=0x61646d696e

B : AND database()=HEX('admin')

C : AND database()=0x61646d696e

D : UNION SELECT 0x61646d696e

Answer: C