Confidently Practice Online with Free OSWA Exam Cram

Practice your OffSec Web Assessor (OSWA) certification test with free OSWA exam cram and take control of your certification preparation. At FreeExamCram, you can practice online for free using real OSWA exam dumps, verified questions, and expert-designed free online practice tests. Moreover our OffSec OSWA exam cram backed by our confidence-boosting refund guarantee.

Question 1

Developer says “we sanitize server output.” You suspect a DOM sink. Which minimal probe best surfaces a client-side sink without server reflection?

Options :

A :

B :

C :

D :

Answer: C

Question 2

A site implements CSRF protection via double-submit cookies. You notice that SameSite is set to Lax. Which crafted request bypasses protection?

Options :

A :

B :

C :

D : Both B and C

Answer: D

Question 3

Developer says “we sanitize server output.” You suspect a DOM sink. Which minimal probe best surfaces a client-side sink without server reflection?

Options :

A :

B :

C :

D :

Answer: C

Question 4

A server validates Host headers strictly to cdn.example.com. You want SSRF against localhost.

Which technique is MOST effective?

Options :

A : Use 127.0.0.1 directly

B : Use localhost.example.co

C : Use a DNS rebinding domain that resolves to 127.0.0.1 after initial validation

D : Use %2elocalhost encoding

Answer: C

Question 5

You want to discover hidden parameters influenced by a CDN.

What is the best initial approach in Burp?

Options :

A : Intruder Sniper with FUZZ in the query string

B : Use Param Miner extension with both “Guess headers” and “Add custom parameter names from traffic” enabled

C : Use Proxy → HTTP history and manually diff responses

D : Use Comparer to compare two baseline responses

Answer: B