1- The Question Is talking About the Cryptography and simply it it the salting concept that add a random value to the hash to make it unique and the main Purpose for the salting is defending the hash from The rainbow table dictionary attacks Which is answer
"A"
2- To Prevent The click jacking attack we add the appropriate directive in the CSP HTTP response header is "frame-ancestors" The Frame ancestors in the CSP specifies which sources are allowed to embed the webpage in an iframe " <frame> OR <object> " but denying framing through this directly so Protecting the Web Application from Click-jacking attack Which is Answer
"C"
3- Here The question Talking about is vulerable to Xss which is not possible to do ok steal the user`s session is possible when the cookie is not in the HttpOnly cookie , Stael the Contents from the web page also possible , steal contents from the users keystroke yeah it also possible we talking about injecting a Script to webpage xss is much more critical than alert BTW so steal the contents for the application database it`s not possible Which is Answer
"C"
4-Here From first look we can detect That we are talking about File Upload Vulnerability and this is the important you have one minute BTW but let analysis the questions Http Desync attack which is Request Smuggling and it` work by confuse how intermediary servers (such as proxies, load balancers, or firewalls) process requests before they reach the intended destination and it will be usually the back end Server and it target the content length and the host i think here there is not , File path Traversal i didn`t see any Payloads try to enter the server , SSRF i Also didn`t see payloads try to re forced the web-application to a server belongs to the attacker so it`s File upload Definitely there is a parameter for the filename will burn our eyes (: Which is Answer
"C"
5- Which Combination is vulnerable simply when Access-Control-Allow-Origin is set to * it`s mean that any domain can make request to the server and if Access-Control-Allow-Credentials to true it allows cross-origin requests to include credentials, such as session cookies or authentication headers Which is Answer
"A"
6- To Be Honest I Saw the Developer is look like Hagres Tell Hey Attackers Hackers this is the framework name and the version come and concentrate on This version and try to Found a bug simply in this request easily the attacker can see the version and framework Which is Answer
"A"
"B"
8- Here we are talking for the protocols Versions OK {SSLv2 and SSLv3} is insecure due to vulnerabilities like iPOODLE attack and the lack of Cryptography Techniques {TLSv1.0,TLSv2.0} Is Improvement for the ssl but it also vulnerable to BEAST and Lucky 13 attacks {TLSv1.1 and 1.3 } Is considered Secure so the Answer is
"C"
9-Here The Response contain all the above disclose the server version and disclose the framework used and also used outdated server which is Answer
"D"
10-The browser contain Public key trusted CA and stored in browser and also contain TLs certificate to the browser uses the CA’s public key and private key when signature matches, the browser knows the certificate is legitimate Which is Answer
"B"
11-What is the WordPress file Contain all this Details is WP-conf don`t be hesitate and choose WP-secret (: Which answer
"B"
12-The Function is used to read The contents of a file from the server file is Load_file Function Which is Answer
"B"
13-Which Is safe Password it`s easy BTW The password that contain small and large and numbers and special Characters Which is Answer
"C"
14-Here This request didn`t contain any method to prevent CSRF attack token for example and this is easily lead the attacker form a post request and smoothly change the password which is Answer
"C"
15-Here in this Request Easily we can detect the payload for the LFI so simply it`s path traversal which is Answer
"B"
16-After Analysis the code the Most applicable for this scenario is Component with know vulnerability use old third party library like j query 1.8.6 leads to a leak of security Which is answer
"C"
17- After break out each link we can easily detect that the first link is only have same host,scheme and port as original URL Which is Answer
"A"
18- The problem are described her is IDOR vulnerability where the attacker can manipulate parameters that can access information not authorized to view So by validating the user privilege and the weakness of authorization the issue can be fixed which is Answer
"B"
19- The docker-compose.yml file is a configuration file used by Docker Compose to define and manage multi-container Docker applications It allows you to describe the services your application needs, such as databases, web servers, and application servers, as well as how they interact (e.g., networks, volumes). Key data that can be found in this file include services, networks, volumes,Environment variables but is doesn`t contain server logs , session information , load balancer and firewall which is Answer
"C"
"A"
"A"
"A"
23-The null Bytes as \0 in the most of languages so after encoded it simply be %00 and BTW null bytes leads to a lot of injections to bypass the input validation Which is Answer
"D"
"A"
25-When We talking about Finding directory listing in Google Dorks We Can Used {intitle& intext} which is Answer
"C"
26-The Race Condition Happens when two or more threads or processes attempt to access or modify the same resource concurrently Which Is Answer
"A"
27-Every Bug has a most common Payloads when we Saw them we directly Know the bug And this our payload Here we talking about SSTI which is Answer
"A"
"C"
29-In The context of Dependency of Confusion Attack occurs when attackers take advantage of package managers For Node.js {package.JSON} , for Python {Requirements.txt} Which is Answer
"C"
30-IN This Question We talking about SAML Security and simply Xml Signature Wrapping , XXE , Reply attack the three is attacks related to SAML Which is Answer
"D"
31- Here We talking about NoSql Injection Scenarios and The both Statements are Accurate Which is Answer
"D"
32- Here We Have JWT Token and jwt token consists of three parts separated by dot {Header, Payload, Signature} This Highlighted part shows is the Header Which is Answer
"A"
33- Here We are with the same token and the blue part represent the signature Which is Answer
"B"
"D"
35- Here we talking about xmlrpc.php endpoint and the only CMS uses this is WP which is Answer
"A"
36- When We talking about the most effective way to prevent XSS Simply it`s Whitelisting Which is Answer
"B"
37- The security attribute send the cookie over TLS channel is Secure Attribute Which is Answer
"A"
38- Where We talking about robots.txt Which is the developers must not list any sensitive Info on it because it`s easy to be Crawled Which is Answer
"A"
39-Here We Talking about Purchasing item and the Most vulnerability hits this website is IDOR and this is our Scenario here which is Answer
"A"
40-Here We Have again the IDOR Scenario and simply the two solutions will not fix the problem because simply the hacker can decode The Base64 and the hash value also can be determined Which is Answer
"B"
"A"
42-In This Login Page We can easily determine That the code is Vulnerable to Username enumeration because it simply tell us that this user not exist so i will give you a list contain 10 million name and one will be exist Inshaallah (: Which is Answer
"A"
43- To Prevent Click jacking attack we specifically designed x-frame-options {It controls whether a browser should be allowed to render a page in <frame>, <iframe> etc} Which is Answer
"C"
44- Here All this Attacks is Server Side except XXS is client side Which is Answer
"B"
45-Here We can easily detect that The link uses insecure channel by use http and also the reset link includes user token Which is Answer
"D"
46-In This question we again didn`t Solve the Previous Problem for the token Which is Answer
"B"
47-The Most Secure Algorithm is Bcrypt Which is Answer
"D"
48-Here The only algorithm Not ASymmertric is AES Which is Answer
"A"
49- Here Don`t Be Hasetate it` s not the same Question it`s the opposite BTW (: Which is Answer
"D"
50-Here When you Look at the request we will find That the attacker put the local host / admin which is Directly SSRF Which is Answer
"D"
51-Here all the statments is true The application uses http and also used get and also vulnerable to xss Which is Answer
"D"
52-Here we didn`t have any defending Mechanism against CSRF no token same site attribute Which is Answer
"A"
53-When The TLS Certificate is expired the connection is Still over it but the browser will give error Which is Answer
"B"
54- Sure The admin Renew the Certificate Which is Answer
"B"
55-MFA didn`t affect on XSS or CSRF also LFI and RFI Which is Answer
"D"
56- All This attributes is Used to secure Cookie Except Restrict Which is Answer
"C"
"B"
"A"
59-Here is a XSS payload uses src Which is Answer
"A"
60-Here The Post Request shown The Xml injection payload Which is Simply Anwer
"D"
Whooha Finally Finished Nice Exam Thanks For Reading (:
