Question 1

You find:

POST /upload

{"filename":"invoice.pdf","path":"/users/123/docs/"}

Which exploitation demonstrates maximum impact?

Options :

A : Uploading to /users/456/docs/

B : Uploading a 0-byte file

C : Overwriting your own invoice.pdf

D : Sending malformed JSON to crash parser

Answer: A

Question 2

You need to exploit a CSRF in a stock trading platform. The target action is:

The app accepts requests only from Origin: https://trading.local.

Which CSRF payload is most likely to bypass defenses?

Options :

A :

B :

C :

D :

Answer: D

Question 3

You want to discover hidden parameters influenced by a CDN.

What is the best initial approach in Burp?

Options :

A : Intruder Sniper with FUZZ in the query string

B : Use Param Miner extension with both “Guess headers” and “Add custom parameter names from traffic” enabled

C : Use Proxy → HTTP history and manually diff responses

D : Use Comparer to compare two baseline responses

Answer: B

Question 4

Developer says “we sanitize server output.” You suspect a DOM sink. Which minimal probe best surfaces a client-side sink without server reflection?

Options :

A :

B :

C :

D :

Answer: C

Question 5

You want to discover hidden parameters influenced by a CDN.

What is the best initial approach in Burp?

Options :

A : Intruder Sniper with FUZZ in the query string

B : Use Param Miner extension with both “Guess headers” and “Add custom parameter names from traffic” enabled

C : Use Proxy → HTTP history and manually diff responses

D : Use Comparer to compare two baseline responses

Answer: B

Free OSWA Mock Exam – Practice Online Confidently