Q2: How to test a web app for communication patterns (beaconing,
vulnerabilities? encrypted traffic to unknown IPs).
Use Burp Suite for request
tampering.
Test for SQL Injection (SQLi) (send ' Q5: Ensuring accuracy in
OR 1=1 -- in login forms). penetration testing?
Check for Cross-Site Scripting (XSS) Verify manually (don’t trust tools
(<script>alert(1)</script> in inputs). blindly).
Look for IDOR (change user_id=123 to Cross-check using multiple tools
user_id=124 to access others’ data). (Nmap, Nessus, Burp Suite, manual
tests).
Break business logic (e.g., bypassing
price validation in e-commerce). Contextualize – Prioritize real-world
exploitability, not just scanner alerts.
Bonus Tip: Think like a real attacker,
Q3: Bypassing a WAF? not just a checklist tester!
Encode the payload (Base64, Hex,
URL encoding).
Split the attack (fragment SQLi/XSS Q4: Testing & Exploiting Active
payloads). Directory (AD)?
Smuggle HTTP requests (HTTP Desync Enumeration – Use BloodHound,
attacks). CrackMapExec to find weak users.
Customize payloads (modify headers, Kerberoasting – Extract service
use non-standard syntax). account hashes and crack them.
NTLM Relay – Intercept and relay
authentication to access AD.
APT attack indicators is using “4 L’s”: Privilege Escalation – Use Pass-the-
1.Long-term presence – Attackers stay Hash, Golden Ticket for admin access.
hidden for months or years, gathering
intelligence.
2.Lateral movement – They spread
across systems using tools like Mimikatz
or Pass-the-Hash.
3.Leaked data – Unusual data transfers
(large files moving outside the network).
4.Listening for commands – C2
(Command & Control) traffic with odd
API Security Testing Questions Q7: How would you test an API for
SQL Injection and NoSQL Injection?
Q1: What are the key vulnerabilities
➡ Hint: Try injecting SQL payloads (' OR
you look for when testing an API?
'1'='1), NoSQL queries ({"$ne": null})
➡ Hint: Think about OWASP API Security
into API parameters.
Top 10 – Broken Authentication,
Excessive Data Exposure, Rate Limiting Q8: What steps would you take to
issues. test an API for business logic
vulnerabilities?
Q2: How do you test an API for
➡ Hint: Think workflow abuse, duplicate
authentication and authorization
transactions, privilege escalation
weaknesses?
through logic flaws.
➡ Hint: Try JWT manipulation, token
reuse, role-based access bypass Q9: How do you ensure API security
(IDOR). against MITM attacks?
➡ Hint: Check for HTTPS enforcement,
Q3: How would you perform fuzz
HSTS headers, weak TLS versions.
testing on an API?
➡ Hint: Use Burp Suite Intruder, ffuf, or
ZAP to send random/malicious inputs.
Q4: What are some ways to bypass
API rate limiting?
➡ Hint: Rotate IPs, use X-Forwarded-
For headers, token reuse, HTTP
pipelining.
Q5: How do you check for sensitive
data exposure in an API?
➡ Hint: Look for unfiltered responses,
debug info, and exposed secrets in
JSON/XML responses.
Q6: What tools do you use for API
security testing?
➡ Hint: Postman (manual), Burp Suite,
OWASP ZAP, and Kiterunner for
discovery.
3. Cloud & Enterprise Security
Q9: Assessing Cloud Security Q7: Stealthy Persistence in Red
(AWS/Azure)? Teaming?
➡ Remember: IAM, Storage, Public ➡ Remember: LOLbins, Scripts, C2
Exposure LOLbins – Use trusted Windows tools
Check IAM for misconfigurations like rundll32.exe, mshta.exe to execute
(overprivileged users, unused payloads.
accounts). PowerShell Empire – Script-based
Find exposed storage (open S3 persistence without dropping files.
buckets, public Azure Blobs). DLL Sideloading – Place malicious
Identify public-facing services (EC2, DLLs where trusted apps load them.
RDS, misconfigured APIs). C2 Frameworks – Cobalt Strike,
Look for privilege escalation via Sliver, Mythic for remote control.
misconfigured policies.
Check container security (weak
Kubernetes RBAC, insecure images). Q8: Conducting a Threat Hunt?
➡ Remember: Logs, TTPs, EDR
Analyze logs from SIEM (Splunk,
2. Red Teaming & Threat Hunting ELK).
Q6: Difference between Penetration Look for anomalies in network traffic,
Testing and Red Teaming? login patterns.
➡ Remember: PT = Find Vulns, RT = Act Use MITRE ATT&CK to map attacker
Like a Real Attacker behaviors.
Penetration Testing – Finds security Check EDR data (Defender ATP,
weaknesses using known attack CrowdStrike) for suspicious endpoint
techniques. activity.
Red Teaming – Simulates real-world
attackers, focusing on stealth,
persistence, and multi-step attacks to
evade detection.
