Score Higher on Verified CAP | Certified AppSec Practitioner Exam Questions with Answers

The request is a POST to /dashboard/userdata with a parameter useragent=http://127.0.0.1/admin. The response is a 200 OK with an HTML page titled "Admin Panel," suggesting the server processed the request and returned content from http://127.0.0.1/admin. Let’s evaluate the vulnerability:

Analysis: The useragent parameter contains a URL (http://127.0.0.1/admin), and the server appears to fetch content from this URL, as indicated by the response containing the "Admin Panel" page. The URL 127.0.0.1 refers to the server’s localhost, meaning the server is making an internal request to itself based on user input. This is a hallmark of Server-Side Request Forgery (SSRF), where an attacker can trick the server into making requests to arbitrary locations, including internal systems (e.g., 127.0.0.1) or external sites. SSRF can lead to accessing internal resources (e.g., admin panels, metadata endpoints) or performing unauthorized actions.

Option A ("HTTP Desync Attack"): HTTP Desync attacks exploit discrepancies in how front-end and back-end servers interpret HTTP requests (e.g., smuggling requests). This scenario involves a straightforward POST request with no evidence of desynchronization or smuggling, so this is incorrect.

Option B ("File Path Traversal Attack"): File Path Traversal involves manipulating file paths (e.g., ../../etc/passwd) to access unauthorized files on the server’s filesystem. The useragent parameter contains a URL, not a file path, and the response indicates a web request, not filesystem access, so this is incorrect.

Option C ("Open URL Redirection"): Open URL Redirection occurs when the server redirects the client to a user-supplied URL (e.g., via a Location header). The response here is a 200 OK, not a redirect (e.g., 302 Found), and the server is fetching content server-side, not redirecting the client, so this is incorrect.

Option D ("Server-Side Request Forgery"): Correct, as the server is making a request to http://127.0.0.1/admin based on the useragent parameter, indicating an SSRF vulnerability.

The correct answer is D, aligning with the CAP syllabus under "Server-Side Request Forgery (SSRF)" and "OWASP Top 10 (A10:2021 - Server-Side Request Forgery)."References: SecOps Group CAP Documents - "SSRF Vulnerabilities," "Input Validation for URLs," and "OWASP SSRF Prevention Cheat Sheet" sections.

SQL injection vulnerabilities allow attackers to manipulate database queries, potentially accessing unauthorized data, including file contents, if the database supports such operations. In MySQL, theLOAD_FILE()function is specifically designed to read the contents of a file on the server where the database is hosted, provided the file exists, the database user has appropriate privileges (e.g., FILE privilege), and the file is readable. For example, SELECT LOAD_FILE('/etc/passwd') could extract the contents of the /etc/passwd file if exploitable.

Option A ("READ_FILE()"): This is not a valid MySQL function.

Option B ("LOAD_FILE()"): This is the correct function for reading file contents in MySQL, making it the right choice for exploitation.

Option C ("FETCH_FILE()"): This is not a recognized MySQL function.

Option D ("GET_FILE()"): This is also not a valid MySQL function.

The correct answer is B, aligning with the CAP syllabus under "SQL Injection" and "Database Security."References: SecOps Group CAP Documents - "Injection Vulnerabilities," "MySQL Security Features," and "OWASP Top 10 (A03:2021 - Injection)" sections.

This question is identical to Question 52, describing a scenario where a TLS certificate has expired, causing a TLS error message, and asking about the correct course of action. The analysis remains the same:

Option A ("There is no urgency to renew the certificate as the communication is still over TLS"): Incorrect. An expired TLS certificate invalidates the trust model, even if the connection technically uses TLS. Browsers will issue warnings, and users may bypass them, but the lack of a valid certificate compromises security, making renewal urgent.

Option B ("There is an urgency to renew the certificate as the users of the website may get conditioned to ignore TLS warnings and therefore ignore a legitimate warning which could be a real Man-in-the-Middle attack"): Correct. Repeated exposure to TLS warnings due to an expired certificate may desensitize users, increasing the risk that they ignore legitimate warnings from a Man-in-the-Middle (MitM) attack. Renewing the certificate promptly is essential to maintain security and user trust.

The correct answer is B, aligning with the CAP syllabus under "TLS Configuration" and "Certificate Management."References: SecOps Group CAP Documents - "TLS Security," "Certificate Expiry Management," and "OWASP Transport Layer Protection Cheat Sheet" sections.