Free The SecOps Group secops-CAP Practice Exams

Question #1

Null Byte Injection is an active exploitation technique used to bypass sanity-checking filters in web applications by adding a URL-encoded null byte character to the user-supplied data.

Which of the following is a URL-encoded representation of a null byte?

A . %01
B . %10
C . %25
D . %00

Reveal Solution Hide Solution

Question #2

In the screenshot below, which of the following is incorrect?

Target: https://example.com

HTTP/1.1 404 Not Found

Date: Fri, 09 Dec 2022 18:03:49 GMT

Server: Apache

Vary: Cookie

X-Powered-By: PHP/5.4.5-5

X-Xss-Protection: 1; mode=block

X-Content-Type-Options: nosniff

Content-Length: 0

Content-Type: text/html; charset=UTF-8

Cookie: JSESSIONID=1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789; secure; HttpOnly; SameSite=None

A . The application discloses the framework name and version
B . The application reveals user-agent details
C . A cookie is set with HttpOnly and a Secure flag
D . The application accepts insecure protocol

Reveal Solution Hide Solution

Question #3

You found the xmrpc.php endpoint while performing a security assessment on a web application.

The target application is most likely using which of the following Content Management Systems (CMS)?

A . WordPress
B . Drupal
C . Both A and B
D . None of the above

Reveal Solution Hide Solution

Question #4

In the screenshot below, an attacker is attempting to exploit which vulnerability?

POST /dashboard HTTP/1.1

Host: example.com

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) rv:107.0) Gecko/20100101 Firefox/107.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: en-GB,en;q=0.5

Accept-Encoding: gzip, deflate

Upgrade-Insecure-Requests: 1

Sec-Fetch-Dest: document

Sec-Fetch-Mode: navigate

Sec-Fetch-Site: none

Sec-Fetch-User: ?1

Cookie: JSESSIONID=7576572ce164646de967c759643d53031

Te: trailers

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 81

xml_foo=<ENTITY example SYSTEM "file:///etc/passwd">]><foo>&example;</foo>

<!DOCTYPE foo [<!ENTITY example SYSTEM "file:///etc/passwd">]><foo>&example;</foo>

<foo>&example;</foo>

<title>Project Meeting</title>

<time>1200</time>

<location>changed example</location>

</body>

A . Path Traversal Attack
B . Server Side Template Injection
C . XML Bomb Attack
D . XML External Entity Attack

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

The request is a POST to /dashboard with a payload containing XML data, specifically an xml_foo parameter with a <!DOCTYPE> declaration and an XML entity (<!ENTITY example SYSTEM "file:///etc/passwd">).

Let’s analyze the vulnerability:

The payload defines an XML External Entity (XXE) with <!ENTITY example SYSTEM "file:///etc/passwd">, which instructs the XML parser to fetch the contents of /etc/passwd (a sensitive system file) and include it in the &example; reference. The XML then includes <foo>&example;</foo>, which would expand to the contents of /etc/passwd if the parser processes the entity.

This is a classic XML External Entity (XXE) Attack, where an attacker exploits an XML parser’s ability to process external entities to access unauthorized resources (e.g., local files, internal network services) or cause denial-of-service. If the application’s XML parser is misconfigured to allow external entity resolution, this attack can disclose sensitive data like /etc/passwd.

Option A ("Path Traversal Attack"): Incorrect. Path Traversal involves manipulating file paths (e.g.,

../../etc/passwd) to access unauthorized files. While the attack aims to access /etc/passwd, it does so via XML entity resolution, not path traversal.

Option B ("Server Side Template Injection"): Incorrect. SSTI (Server-Side Template Injection) involves injecting template expressions (e.g., {{7*7}}) into a server-side template engine. The payload here is XML, not a template expression, and targets XML parsing, not a template engine.

Option C ("XML Bomb Attack"): Incorrect. An XML Bomb (or Billion Laughs attack) involves recursive entity expansion to cause denial-of-service (e.g., <!ENTITY a "&b;&b;"> <!ENTITY b "lol">), leading to exponential growth in memory usage. This payload defines a single external entity to fetch a file, not a recursive expansion, so it’s not an XML Bomb.

Option D ("XML External Entity Attack"): Correct, as the payload exploits XXE by defining an external entity to access /etc/passwd.

The correct answer is D, aligning with the CAP syllabus under "XML External Entity (XXE) Attacks" and "OWASP Top 10 (A04:2021 – Insecure Design)."

Reference: SecOps Group CAP Documents – "XXE Vulnerabilities," "XML Parsing Security," and "OWASP XXE Prevention Cheat Sheet" sections.

Question #5

Based on the screenshot below, which of the following statements is true?

Request

GET /userProfile.php?sessionId=7576572ce164646de967c759643d53031 HTTP/1.1

Host: example.com

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/107.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: en-GB,en;q=0.5

Accept-Encoding: gzip, deflate

Upgrade-Insecure-Requests: 1

Sec-Fetch-Dest: document

Sec-Fetch-Mode: navigate

Sec-Fetch-Site: none

Sec-Fetch-User: ?1

Cookie: JSESSIONID=7576572ce164646de967c759643d53031

Te: trailers

Connection: keep-alive

Pretty Raw | Hex | php | curl | ln | Pretty

HTTP/1.1 200 OK

Date: Fri, 09 Dec 2022 11:42:27 GMT

Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2k-fips PHP/8.0.25

X-Powered-By: PHP/8.0.25

Content-Length: 12746

Content-Type: text/html; charset=UTF-8

Connection: keep-alive

Set-Cookie: JSESSIONID=7576572ce164646de967c759643d53031; Path=/; HttpOnly

<html>

<head>

<meta charset="utf-8">

<meta name="viewport" content="width=device-width, initial-scale=1">

<title>Example Domain</title>

</head>

<body style="background-color:#f0f0f2; margin:0; padding:0; font-family: -apple-system, system-ui, BlinkMacSystemFont, ‘Segoe UI’, ‘Open Sans’, ‘Helvetica Neue’, Helvetica, Arial, sans-serif;"> <p style="…">…</p>

</body>

</html>

A . The application uses an insecure channel (non-TLS)
B . The application uses an insecure HTTP method (GET) to send sensitive information
C . The application is vulnerable to Cross-Site Scripting attacks
D . All of the above

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

The request is a GET to /userProfile.php with a sessionId parameter matching the JSESSIONID cookie, and the response is a 200 OK with an HTML page.

Let’s evaluate the statements:

Option A ("The application uses an insecure channel (non-TLS)"): The request uses http:// (inferred from the absence of https:// in the Host and GET line), indicating a non-TLS channel. However, the question asks about the "application" (likely the server-side behavior), and the response does not explicitly confirm the channel used for the response. Modern browsers might enforce TLS, but the request suggests an insecure channel. This could be true, but it depends on the server’s configuration, making it less certain without further context.

Option B ("The application uses an insecure HTTP method (GET) to send sensitive information"):

Correct. The sessionId parameter in the URL

(/userProfile.php?sessionId=7576572ce164646de967c759643d53031) is sensitive data, as it could be used to hijack the user’s session. Using GET exposes this data in browser history, server logs, and referral headers, which is insecure. Best practice is to use POST for sensitive data to avoid such exposure. The JSESSIONID cookie is marked HttpOnly, mitigating some risks, but the sessionId in the URL remains a vulnerability.

Option C ("The application is vulnerable to Cross-Site Scripting attacks"): The response includes an HTML page with no visible user input or script execution. There’s no evidence of unsanitized input or script injection (e.g., no dynamic content like <script> tags with user data). The X-Xss-Protection: 1; mode=block header (though not shown) would mitigate XSS if present, but the response alone does not indicate vulnerability, so this is incorrect.

Option D ("All of the above"): Incorrect, as only B is definitively true; A is uncertain without confirming the response channel, and C lacks evidence.

The correct answer is B, aligning with the CAP syllabus under "HTTP Methods Security" and "Session Management."

Reference: SecOps Group CAP Documents – "Insecure HTTP Methods," "Sensitive Data Exposure," and "OWASP Secure Coding Practices" sections.

Question #6

Which of the following is NOT an asymmetric key encryption algorithm?

A . AES
B . RSA
C . Diffie-Hellman
D . DSA

Reveal Solution Hide Solution

Question #7

Scan the code below and identify the vulnerability which is the most applicable for this scenario.

<meta charset="utf-8">

<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">

<meta name="description" content="xss">

<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.1/css/bootstrap.min.css" integrity="sha384-WskhaSGFgHYWDcbwN70/dfYBj47jz9qbsMId/iRN3ewGhXQFZCSftd1LZCfmhktB" crossorigin="anonymous">

<link rel="shortcut icon" href="/favicon.ico">

<link charset="utf-8" media="all" type="text/css" href="/static/css/main.css" rel="stylesheet">

<script type="text/javascript"

src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>

A . SQL Injection
B . Type Juggling
C . Component with a Known Vulnerability
D . Server-Side Request Forgery

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

The code snippet shows HTML <meta> and <link> tags, along with a <script> tag, loading external resources:

Bootstrap CSS from cdnjs.cloudflare.com (version 4.1.1) jQuery JavaScript from cdnjs.cloudflare.com (version 3.3.1) Let’s evaluate the potential vulnerabilities:

The resources are loaded from a third-party CDN (cdnjs.cloudflare.com), and the versions specified (Bootstrap 4.1.1 and jQuery 3.3.1) may have known vulnerabilities. For instance, jQuery 3.3.1 has known XSS (Cross-Site Scripting) vulnerabilities (e.g., CVE-2019-11358) that can be exploited if the library is used insecurely. Similarly, Bootstrap 4.1.1 has known issues (e.g., CVE-2018-14041) related to XSS in certain components like tooltips or modals if not configured properly.

The use of outdated or vulnerable third-party components is a Component with a Known Vulnerability, a common issue in web applications. The CAP syllabus emphasizes identifying and mitigating risks from third-party libraries, especially those with known CVEs.

Option A ("SQL Injection"): SQL injection occurs in server-side database queries, not in client-side HTML or JavaScript loading. This code snippet does not involve database interaction, so this is incorrect.

Option B ("Type Juggling"): Type juggling is a PHP-specific vulnerability where loose type comparison (== vs ===) leads to security issues. This code is HTML/JavaScript, not PHP, so type juggling does not apply.

Option C ("Component with a Known Vulnerability"): As explained, the use of potentially outdated jQuery and Bootstrap versions introduces the risk of known vulnerabilities, making this the most applicable answer.

Option D ("Server-Side Request Forgery"): SSRF involves tricking the server into making unauthorized requests, which is not relevant here as the code loads resources in the browser, not on the server. The correct answer is C, aligning with the CAP syllabus under "Component Vulnerabilities" and "OWASP Top 10 (A09:2021 – Using Components with Known Vulnerabilities)."

Reference: SecOps Group CAP Documents – "Third-Party Component Security," "Software Supply Chain Security," and "OWASP Top 10" sections.

Question #8

Based on the below request/response, which of the following statements is true?

Send

GET /dashboard.php?purl=http://attacker.com HTTP/1.1

Host: example.com

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/107.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: en-GB,en;q=0.5

Accept-Encoding: gzip, deflate

Upgrade-Insecure-Requests: 1

Sec-Fetch-Dest: document

Sec-Fetch-Mode: navigate

Sec-Fetch-Site: none

Sec-Fetch-User: ?1

Cookie: JSESSIONID=38RB5ECV10785B53AF29816E92E2E50

Te: trailers

Connection: keep-alive

Pretty Raw | Hex | php | curl | ln | Pretty

HTTP/1.1 302 Found 2022-12-03 17:38:18 GMT

Date: Sat, 03 Dec 2022 17:38:18 GMT

Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2k-fips PHP/8.0.25

X-Powered-By: PHP/8.0.25

Content-Length: 0

Content-Type: text/html; charset=UTF-8

Connection: keep-alive

Location: http://attacker.com

Set-Cookie: JSESSIONID=38C5ECV10785B53AF29816E92E2E50; Path=/; HttpOnly

A . Application is likely to be vulnerable to Open Redirection vulnerability
B . Application is vulnerable to Cross-Site Request Forgery vulnerability
C . Application uses an insecure protocol
D . All of the above

Reveal Solution Hide Solution

Question #9

Which of the following SSL/TLS protocols are considered to be insecure?

A . SSLv2 and SSLv3
B . TLSv1.0 and TLSv1.1
C . Both A and B
D . SSLv2, SSLv3, TLSv1.0, TLSv1.1, TLSv1.2 and TLSv1.3

Reveal Solution Hide Solution

Question #10

What is the name of the WordPress file that contains the database connection information, including the database name, username, and password?

A . wp-configuration.php
B . wp-conf.php
C . wp-secret.php
D . wp-config.php

Reveal Solution Hide Solution