Free OffSec OSWA Exam Questions
Absolute Free OSWA Exam Practice for Comprehensive Preparation
-
OffSec OSWA Exam Questions
-
Provided By: OffSec
- Exam: OffSec Web Assessor (OSWA)
- Certification: Offensive Penetration Testing
-
Total Questions: 180
-
Updated On: Sep 04, 2026
-
Rated: 4.9 |
-
Online Users: 360
-
Question 1
-
During testing, you find a REST endpoint:GET /api/v1/users/1234/profileAuthenticated as a normal user, you can access your own profile. Changing ID 1234 to 1001 retrieves another user’s data. Which methodology most reliably proves mass exploitation feasibility without detection?
Answer: D
-
During testing, you find a REST endpoint:GET /api/v1/users/1234/profileAuthenticated as a normal user, you can access your own profile. Changing ID 1234 to 1001 retrieves another user’s data. Which methodology most reliably proves mass exploitation feasibility without detection?
-
Question 2
-
Developer says “we sanitize server output.” You suspect a DOM sink. Which minimal probe best surfaces a client-side sink without server reflection?
Answer: C
-
Developer says “we sanitize server output.” You suspect a DOM sink. Which minimal probe best surfaces a client-side sink without server reflection?
-
Question 3
-
A site implements CSRF protection via double-submit cookies. You notice that SameSite is set to Lax. Which crafted request bypasses protection?
Answer: D
-
A site implements CSRF protection via double-submit cookies. You notice that SameSite is set to Lax. Which crafted request bypasses protection?
-
Question 4
-
* * * * * tar -czf /root/backup.tar /home/user/*Which filenames trigger escalation? (Select all that apply)
Answer: A,B
-
* * * * * tar -czf /root/backup.tar /home/user/*Which filenames trigger escalation? (Select all that apply)
-
Question 5
-
* * * * * tar -czf /root/backup.tar /home/user/*Which filenames trigger escalation? (Select all that apply)
Answer: A,B
-
* * * * * tar -czf /root/backup.tar /home/user/*Which filenames trigger escalation? (Select all that apply)