Free OffSec OSWA Practice Exam Questions and Answers 2026

Start Learning with the Newest and 100% Free OSWA Exam Dumps Questions

Page: 1 / 36

Total 180 Questions | Updated On: Apr 01, 2026

Add To Cart

Question 1

You inject payload:Which vulnerability chain is demonstrated?

A : Stored XSS → CSRF with session context

B : SQLi → Privilege escalation

C : CSRF → XSS → DoS

D : IDOR → XSS → CSRF

Answer: A

Question 2

A healthcare portal blocks standard CSRF submissions, but accepts GET requests with sensitive parameters. You need to trick a logged-in doctor into issuing a prescription refill.Which payload works best?

A :

B :

C : Both A and B

D : Neither

Answer: C

Question 3

You discover a DOM-based AngularJS template injection in a single-page application where user input is embedded in the following context:The application uses AngularJS 1.6.4 (sandbox still partially intact) and the developer added:$sceProvider.enabled(false);Which payload would most reliably break out of the sandbox and execute alert(1337)?

A : {{constructor.constructor('alert(1337)')()}}

B : {{(a=toString().constructor)('alert(1337)')()}}

C : {{[].map.constructor('alert(1337)')()}}

D : {{[].sort.constructor('alert(1337)')()}}

Answer: C

Question 4

What’s the most reliable exploit?

A :

B :

C :

D :

Answer: D

Question 5

An image thumbnailer service accepts a url and fetches the image server-side. The server runs inside AWS. You can supply gopher:// URIs.Which chain most likely yields temporary AWS credentials that let you enumerate S3 buckets in the same account?

A : Use SSRF to http://169.254.169.254/latest/meta-data/iam/security-credentials/ and then fetch the role name and token.

B : Submit gopher://169.254.169.254:80/_GET%20/... to craft precise TCP requests to metadata endpoint.

C : Use SSRF to query http://metadata.google.internal instead.

D : Use SSRF to initiate a reverse shell back to you.

Answer: B

Page: 1 / 36

Total 180 Questions | Updated On: Apr 01, 2026

Add To Cart