Question 1

An image thumbnailer service accepts a url and fetches the image server-side. The server runs inside AWS. You can supply gopher:// URIs.

Which chain most likely yields temporary AWS credentials that let you enumerate S3 buckets in the same account?

Options :

A : Use SSRF to http://169.254.169.254/latest/meta-data/iam/security-credentials/ and then fetch the role name and token.

B : Submit gopher://169.254.169.254:80/_GET%20/... to craft precise TCP requests to metadata endpoint.

C : Use SSRF to query http://metadata.google.internal instead.

D : Use SSRF to initiate a reverse shell back to you.

Answer: B

Question 2

You discover a DOM-based AngularJS template injection in a single-page application where user input is embedded in the following context:

The application uses AngularJS 1.6.4 (sandbox still partially intact) and the developer added:

$sceProvider.enabled(false);

Which payload would most reliably break out of the sandbox and execute alert(1337)?

Options :

A : {{constructor.constructor('alert(1337)')()}}

B : {{(a=toString().constructor)('alert(1337)')()}}

C : {{[].map.constructor('alert(1337)')()}}

D : {{[].sort.constructor('alert(1337)')()}}

Answer: C

Question 3

During testing, you find a REST endpoint:

GET /api/v1/users/1234/profile

Authenticated as a normal user, you can access your own profile. Changing ID 1234 to 1001 retrieves another user’s data. Which methodology most reliably proves mass exploitation feasibility without detection?

Options :

A : Burp Intruder brute-forcing all IDs with 200 threads.

B : ffuf sequential fuzzing with -t 1 and rate limiting.

C : Using SQLMap to brute-force numeric IDs.

D : Writing a custom Python script with exponential backoff + anomaly detection bypass.

Answer: D

Question 4

You gain SELECT access via SQLi on MySQL. You want SUPER privileges.

What technique applies?

Options :

A : Exploit INTO OUTFILE to drop reverse shell

B : Abuse SET GLOBAL general_log_file + write webshell

C : Elevate using UNION SELECT grant_option_priv

D : Modify mysql.user directly with injected UPDATE

Answer: D

Question 5

Developer says “we sanitize server output.” You suspect a DOM sink. Which minimal probe best surfaces a client-side sink without server reflection?

Options :

A :

B :

C :

D :

Answer: C

Confidently Practice Online with Free OSWA Exam Cram

Buying Options: