Sample Questions from Offensive Security Certified Professional (OSCP) by OffSec

Preview a few questions below — answers are revealed when you take the exam.

1. A team needs to exploit a SQL injection vulnerability in a web application. They have identified the injection point and confirmed that the database is vulnerable. What approach should they take to extract sensitive data from the database?

   • Utilize automated SQL injection tools to extract data without manual intervention.
   • Manually craft SQL queries to extract data, using techniques like UNION-based or error-based SQL injection.
   • Perform a brute-force attack on the database to guess the table and column names.
   • Use a cross-site scripting (XSS) attack to steal session cookies and gain access to the database.

2. Consider the situation where a penetration tester has gained a low-privilege shell on a target machine. Which method solves it best for escalating privileges to gain administrative access?

   • Run a kernel exploit to gain root access immediately.
   • Search for misconfigured sudo permissions and exploit them to gain higher privileges.
   • Use a password cracking tool to guess the root password.
   • Attempt a brute-force attack on the SSH service to gain root access.

3. Which option best evaluates the effectiveness of a buffer overflow exploit against a specific application?

   • Check if the application crashes upon input of a large buffer.
   • Verify if the application allows arbitrary code execution after the buffer overflow.
   • Ensure that the application logs the buffer overflow attempt.
   • Confirm that the application applies input validation to prevent buffer overflows.

4. How should a professional assess the security posture of a network with multiple legacy systems?

   • Conduct a comprehensive vulnerability assessment and penetration testing of all systems.
   • Rely solely on automated vulnerability scanning tools to identify issues.
   • Assume that legacy systems are secure due to their age and lack of recent updates.
   • Focus only on the newest systems and ignore the legacy ones during the assessment.

5. What strategy should be applied when attempting to bypass a web application firewall (WAF)?

   • Use SQL injection techniques that are known to be effective against WAFs.
   • Encode payloads using various methods to evade detection by the WAF.
   • Attempt brute-force attacks to overwhelm the WAF and gain access.
   • Use social engineering to trick administrators into disabling the WAF.