最新的The SecOps Group Certified AppSec Practitioner - CAP免費考試真題
A website administrator forgot to renew the TLS certificate on time and as a result, the application is now displaying a TLS error message. However, on closer inspection, it appears that the error is due to the TLS certificate expiry.
Which of the following is correct?
Which of the following is correct?
正確答案: A
說明：（僅 Fast2test 成員可見）
You found the xmrpc.php endpoint while performing a security assessment on a web application. The target application is most likely using which of the following Content Management Systems (CMS)?
正確答案: A
說明：（僅 Fast2test 成員可見）
What is the full form of SAML?
正確答案: D
說明：（僅 Fast2test 成員可見）
Based on the below request/response, which of the following statements is true?
Send
GET
/dashboard.php?purl=http://attacker.com HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1 Cookie: JSESSIONID=38RB5ECV10785B53AF29816E92E2E50 Te: trailers Connection: keep-alive PrettyRaw | Hex | php | curl | ln | Pretty HTTP/1.1 302 Found 2022-12-03 17:38:18 GMT Date: Sat, 03 Dec 2022 17:38:18 GMT Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2k-fips PHP/8.0.25 X-Powered-By: PHP/8.0.25 Content-Length: 0 Content-Type: text/html; charset=UTF-8 Connection: keep-alive Location:
http://attacker.com
Set-Cookie: JSESSIONID=38C5ECV10785B53AF29816E92E2E50; Path=/; HttpOnly
Send
GET
/dashboard.php?purl=http://attacker.com HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1 Cookie: JSESSIONID=38RB5ECV10785B53AF29816E92E2E50 Te: trailers Connection: keep-alive PrettyRaw | Hex | php | curl | ln | Pretty HTTP/1.1 302 Found 2022-12-03 17:38:18 GMT Date: Sat, 03 Dec 2022 17:38:18 GMT Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2k-fips PHP/8.0.25 X-Powered-By: PHP/8.0.25 Content-Length: 0 Content-Type: text/html; charset=UTF-8 Connection: keep-alive Location:
http://attacker.com
Set-Cookie: JSESSIONID=38C5ECV10785B53AF29816E92E2E50; Path=/; HttpOnly
正確答案: D
說明：（僅 Fast2test 成員可見）
In the screenshot below, an attacker is attempting to exploit which vulnerability?
POST /dashboard HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) rv:107.0) Gecko/20100101 Firefox/107.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1 Cookie: JSESSIONID=7576572ce164646de967c759643d53031 Te: trailers Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 81 xml_foo=<ENTITY example SYSTEM "file:///etc/passwd">]><foo>&example;</foo>
<!DOCTYPE foo [<!ENTITY example SYSTEM "file:///etc/passwd">]><foo>&example;</foo>
<foo>&example;</foo>
<title>Project Meeting</title>
<time>1200</time>
<location>changed example</location>
</body>
POST /dashboard HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) rv:107.0) Gecko/20100101 Firefox/107.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1 Cookie: JSESSIONID=7576572ce164646de967c759643d53031 Te: trailers Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 81 xml_foo=<ENTITY example SYSTEM "file:///etc/passwd">]><foo>&example;</foo>
<!DOCTYPE foo [<!ENTITY example SYSTEM "file:///etc/passwd">]><foo>&example;</foo>
<foo>&example;</foo>
<title>Project Meeting</title>
<time>1200</time>
<location>changed example</location>
</body>
正確答案: B
說明：（僅 Fast2test 成員可見）
If the end-user input is not validated or sanitized, an application created using which of the following languages or frameworks might be prone to Insecure Deserialization vulnerability?
正確答案: D
說明：（僅 Fast2test 成員可見）