SecOps Group Certification C-APIPen Dumps (V8.02) Set DumpsBase Apart: Continue to Read C-APIPen Free Dumps (Part 2, Q41-Q80) Today

1. An API accepts user input that is rendered in server-side templates.

How would you confirm whether the input field is vulnerable to SSTI?

2. You confirmed that {{7*7}} is evaluated.

What steps would you take to identify the underlying template engine?

3. How would you escalate SSTI in a Jinja2-based application to execute OS commands?

4. The SSTI payload returns __import__ not found.

How can you bypass this to access OS commands?

5. You suspect SSTI in an API that accepts JSON payload.

How would you exploit it?

6. Explain how to find reflected SSTI in HTTP response headers like Location.

7. You want to detect SSTI in error messages.

How would you approach this?

8. How would you detect SSTI vulnerabilities in a GraphQL API?

9. You suspect that SSTI is triggered only in error pages.

How do you test for error-based SSTI?

10. How can you use automated tools to confirm SSTI vulnerabilities in APIs?

11. You find an API endpoint /fetch?url= that fetches a remote URL and returns its content.

How do you test this for SSRF?

12. Describe how to use SSRF to extract AWS EC2 metadata using a vulnerable API endpoint.

13. How can you confirm blind SSRF when no content is reflected in the response?

14. You found a GraphQL API with a query like getRemoteImage(url: ""). Explain how to test this for SSRF.

15. How would you use SSRF to perform port scanning on the internal network?

16. You encounter an image upload API that downloads the image from a URL.

How do you test for SSRF in such behavior?

17. How do you identify SSRF filtering mechanisms and attempt to bypass them?

18. The API blocks IP-based URLs.

How can you leverage open redirect SSRF via external domains?

19. How can you leverage SSRF to exploit Redis or Memcached?

20. Describe how to use Burp Suite to automate SSRF testing across multiple API endpoints.

21. You encounter an API endpoint /api/user?id=5 which fetches user details based on an ID. Explain how you would test this parameter for classic SQL Injection using boolean-based logic.

22. You discover a JSON-based login API that accepts {"username": "admin", "password": "admin"}.

Describe how to test this for NoSQL Injection targeting MongoDB.

23. A form parameter ip=127.0.0.1 is passed to the server, and the server pings it.

How would you test for Unix-based command injection?

24. You notice that the API evaluates math expressions passed via a query string like /eval?expr=2+2.

Describe how to exploit it for code injection.

25. The API uses a parameter name in /api/profile?name=John, which is echoed back in the response.

How would you test this for error-based SQL Injection?

26. You find a GraphQL query that allows user(id: "1"). Describe how to test it for SQL injection within GraphQL queries.

27. You observe a search API that accepts JSON input like {"query": "abc"} and returns product data.

How would you test it for NoSQL Injection?

28. You’re testing an API that evaluates math expressions from JSON like {"expr": "2+2"}.

How can you test this for Python code injection?

29. An endpoint accepts a file path in JSON: {"file": "/var/log/app.log"}.

How do you check for command injection?

30. The server accepts POST data with username=admin and password=admin.

How do you test for SQL Injection if input is not reflected?

31. An API reflects your cookie value in debug mode.

How do you test if the session_id cookie is vulnerable to SQL injection?

32. You suspect command injection in a feature that sends emails and accepts an email address.

How would you test it?

33. You have access to an upload function that renames files server-side.

How would you test this for code injection?

34. The API lets users define custom filters in a query param like filter=price>100.

How would you test this for code or injection?

35. A JSON key called "callback" is passed to the API and affects output.

How would you test for JavaScript injection or server-side code execution?

36. You discover a search API that takes query parameters like /api/search?term=apple.

How would you test it for SQL Injection using stacked queries?

37. The endpoint /api/getUserDetails accepts POST data as {"userId": "101"}.

How do you test this for blind NoSQL injection?

38. An API processes XML input for a user feedback form.

How would you test this for command injection using XML content?

39. You see the backend log leaking file read errors from /etc/passwd when certain inputs are used.

How do you confirm command injection via file read?

40. The system allows you to filter logs with a parameter like level=info.

How would you test this for command injection on Linux?