A penetration tester finds a PHP script used by a web application in an unprotected internal source code repository. After reviewing the code, the tester identifies the following: Which of the…

The correct answer is B. Netcat and cURL. It’s shell exec, not all web app host databases. Burp is a great tool for enumeration and intercepting http requests but that line of code (shell exec) is telling us we could place a reverse shell, trigger it with curl and receive the incoming connection via net at.

Attacks and Exploits

Question

A penetration tester finds a PHP script used by a web application in an unprotected internal source code repository. After reviewing the code, the tester identifies the following:

Which of the following tools will help the tester prepare an attack for this scenario?

Options

AHydra and crunch
BNetcat and cURL
CBurp Suite and DIRB
DNmap and OWASP ZAP

How the community answered

(51 responses)

A
6% (3)
B
71% (36)
C
16% (8)
D
8% (4)

Explanation

It’s shell exec, not all web app host databases. Burp is a great tool for enumeration and intercepting http requests but that line of code (shell exec) is telling us we could place a reverse shell, trigger it with curl and receive the incoming connection via net at.

Topics

#Web Application Exploitation#Source Code Analysis#Exploitation Tools#Command-line Utilities

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice