The SecOps Group CAP Exam Questions

Google Dorks are advanced search operators used to find specific information or vulnerabilities on the web. Directory listing vulnerabilities occur when a web server exposes the contents of a directory (e.g., file names, paths) due to misconfiguration. The operators intitle: and intext: are used to search for specific terms in the title or body of web pages, respectively, combined with site: to limit the search to a specific domain.

Option A ('intitle:'Index of' site:victim-app.com'): Correct, as intitle:'Index of' targets pages with 'Index of' in the title, a common indicator of directory listings, and site:victim-app.com restricts the search to that domain.

Option B ('intext:'Index of' site:victim-app.com'): Correct, as intext:'Index of' searches for 'Index of' within the page content, another reliable indicator of directory listings, combined with the domain restriction.

Option C ('Both A and B'): Correct, as both intitle: and intext: can effectively identify directory listings, making this the most comprehensive answer.

Option D ('None of the above'): Incorrect, as both A and B are valid Google Dorks for this purpose.

The correct answer is C, aligning with the CAP syllabus under 'Reconnaissance Techniques' and 'Google Dorking.'

The vulnerability described is an Insecure Direct Object Reference (IDOR), where manipulating the order_id (e.g., 53870) allows unauthorized access to other users' orders. The fixes proposed by Bob and John aim to obscure the numeric value of order_id to prevent easy guessing or manipulation:

Bob's Fix (SHA1 Hash): Replaces order_id=53870 with order_id=1ff0fe6f1599536d1326418124a261bc98b8ea1 (SHA1 hash of 53870). While this obscures the original value, an attacker can still attempt to hash potential order IDs (e.g., 53871, 53872) and test them in the URL. If the application directly uses the hash to look up the order without validating the user's authorization, the vulnerability persists. SHA1 is a one-way hash, but it does not inherently enforce access control.

John's Fix (Base64 Encoding): Replaces order_id=53870 with order_id=NTM4NzA= (Base64 encoding of 53870). Base64 is a reversible encoding, and an attacker can easily decode NTM4NzA= back to 53870 using standard tools. If the application decodes it and uses the original value to fetch orders without authorization checks, the IDOR vulnerability remains.

Evaluation: Both fixes address the symptom (disclosing the numeric value) but fail to address the root cause: lack of authorization validation. The application must ensure that only the authenticated user can access their own orders, regardless of the order_id format (numeric, hashed, or encoded). Neither fix includes such a check, so the vulnerability persists.

Option A ('Both solutions are adequate to fix the problem'): Incorrect, as neither solution enforces authorization.

Option B ('Both solutions are inadequate and the vulnerability is still not fixed'): Correct, as both SHA1 hashing and Base64 encoding are superficial changes that do not prevent unauthorized access.

Option C ('Only John's solution fixes the problem'): Incorrect, as John's Base64 encoding is reversible and does not fix the IDOR issue.

Option D ('Only Bob's solution fixes the problem'): Incorrect, as Bob's SHA1 hashing also does not address the authorization flaw.

The correct answer is B, aligning with the CAP syllabus under 'Insecure Direct Object Reference (IDOR)' and 'Access Control Best Practices.'

The payload {{7*7}} is a common test string used to detect Server-Side Template Injection (SSTI) vulnerabilities. SSTI occurs when user input is improperly rendered within a server-side template engine (e.g., Jinja2, Freemarker, or Handlebars), allowing the execution of arbitrary template expressions. If the server evaluates {{7*7}} and returns 49 (the result of 7 multiplied by 7), it indicates that the server is processing the input as a template expression, confirming an SSTI vulnerability. This can potentially lead to remote code execution if the template engine supports advanced features.

Option A ('Server Side Template Injection (SSTI)'): Correct, as {{7*7}} is a standard payload to test for SSTI by checking if the server evaluates the expression.

Option B ('Client-Side Template Injection (CSTI)'): Incorrect, as CSTI involves client-side rendering (e.g., JavaScript templates like Mustache), and {{7*7}} would not be evaluated on the client unless explicitly designed to do so, which is not implied here.

Option C ('Both 1 and 2'): Incorrect, as the payload specifically targets server-side processing.

Option D ('None of the above'): Incorrect, as SSTI is applicable.

The correct answer is A, aligning with the CAP syllabus under 'Server-Side Template Injection' and 'Input Validation.'

Clickjacking is an attack where a malicious site overlays a transparent iframe containing a legitimate site, tricking users into interacting with it unintentionally (e.g., clicking a button). The Content-Security-Policy (CSP) HTTP response header is used to mitigate various client-side attacks, including clickjacking, through specific directives. The frame-ancestors directive is the correct choice for preventing clickjacking. This directive specifies which origins are allowed to embed the webpage in an iframe, <frame>, or <object>. For example, setting frame-ancestors 'self' restricts framing to the same origin, effectively blocking external sites from embedding the page. This is a standard defense mechanism recommended by OWASP and other security frameworks.

Option A ('script-src') controls the sources from which scripts can be loaded, addressing XSS (Cross-Site Scripting) vulnerabilities but not clickjacking. Option B ('object-src') restricts the sources of plugins or embedded objects (e.g., Flash), which is unrelated to iframe-based clickjacking. Option D ('base-uri') defines the base URL for relative URLs in the document, offering no protection against framing attacks. The use of CSP with the frame-ancestors directive is a critical topic in the CAP syllabus under 'Security Headers' and 'OWASP Top 10' (UI Redressing).

SQL injection vulnerabilities allow attackers to manipulate database queries, potentially accessing unauthorized data, including file contents, if the database supports such operations. In MySQL, the LOAD_FILE() function is specifically designed to read the contents of a file on the server where the database is hosted, provided the file exists, the database user has appropriate privileges (e.g., FILE privilege), and the file is readable. For example, SELECT LOAD_FILE('/etc/passwd') could extract the contents of the /etc/passwd file if exploitable.

Option A ('READ_FILE()'): This is not a valid MySQL function.

Option B ('LOAD_FILE()'): This is the correct function for reading file contents in MySQL, making it the right choice for exploitation.

Option C ('FETCH_FILE()'): This is not a recognized MySQL function.

Option D ('GET_FILE()'): This is also not a valid MySQL function.

The correct answer is B, aligning with the CAP syllabus under 'SQL Injection' and 'Database Security.'