Question 1

A healthcare portal blocks standard CSRF

Options :

A :

B :

C : Both A and B

D : Neither

Answer: C

Question 2

A WAF blocks single quotes '. Which payload bypasses it to fetch database()?

Options :

A : 0x61646d696e AND database()=0x61646d696e

B : AND database()=HEX('admin')

C : AND database()=0x61646d696e

D : UNION SELECT 0x61646d696e

Answer: C

Question 3

What’s the most reliable exploit?

Options :

A :

B :

C :

D :

Answer: D

Question 4

You need to exploit a CSRF in a stock trading platform. The target action is:

The app accepts requests only from Origin: https://trading.local.

Which CSRF payload is most likely to bypass defenses?

Options :

A :

B :

C :

D :

Answer: D

Question 5

You want to discover hidden parameters influenced by a CDN.

What is the best initial approach in Burp?

Options :

A : Intruder Sniper with FUZZ in the query string

B : Use Param Miner extension with both “Guess headers” and “Add custom parameter names from traffic” enabled

C : Use Proxy → HTTP history and manually diff responses

D : Use Comparer to compare two baseline responses

Answer: B

Higher Test Marks with Free Online OSWA Exam Practice