HTB CWEE Practice Questions - HTB Certified Web Exploitation Expert Exam - HTB CWEE Practice Questions - HTB Certified Web Exploitation Expert Exam

Question 1

In a Server-Side Template Injection (SSTI) attack against a Jinja2 application, which payload is used to enumerate the MRO (Method Resolution Order) and reach the 'os' module for Remote Code Execution?

{{''.__class__.__mro__[1].__subclasses__()}} {{7*7}} $${7*7} <%=7*7%>

Correct Answer:

Question 2

Which Jinja2 SSTI sandbox-escape technique uses the '__globals__' attribute to access the 'os' module without relying on '__subclasses__()'?

{{config.__class__.__init__.__globals__['os'].popen('id').read()}} {{''.__class__.__mro__[-1].__subclasses__()[40]('/etc/passwd').read()}} {{request.application.__globals__.__builtins__.__import__('os').system('id')}} {{self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read()}}

Correct Answer:

{{config.__class__.__init__.__globals__['os'].popen('id').read()}}

Question 3

When testing for SSTI, an application returns '49' for {{7*7}} but '7*7' for ${7*7}. Which template engine is most likely in use?

Jinja2 (Python) Twig (PHP) FreeMarker (Java) Velocity (Java)

Correct Answer:

Jinja2 (Python)

Question 4

In a JavaScript prototype pollution attack, which property path is most commonly targeted to pollute the base Object prototype?

obj.__defineGetter__ obj.__lookupGetter__ obj.prototype.constructor obj.constructor.prototype

Correct Answer:

obj.constructor.prototype

Question 5

A web application merges user-supplied JSON into a configuration object using a recursive deep-merge function. An attacker sends {"__proto__":{"isAdmin":true}}. What is the primary risk?

All subsequently created objects inherit isAdmin:true, enabling privilege escalation The server crashes due to circular reference detection The JSON parser rejects the __proto__ key as invalid syntax Only the merged object is affected; other objects remain unmodified

Correct Answer:

All subsequently created objects inherit isAdmin:true, enabling privilege escalation

Question 1

Exam overview

About this Exam

Prepare with the HTB CWEE Practice Questions - HTB Certified Web Exploitation Expert Exam practice quiz. This question bank includes 100 questions covering attack, application, injection, code, and header. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

HTB CWEE Practice Questions - HTB Certified Web Exploitation Expert Exam

This practice set contains 100 questions from the matching question bank and focuses on attack, application, injection, code, and header. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.

No fixed duration is currently configured for this quiz.

Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.

Yes. You can retake the practice test again as you continue studying during your available access period.

After your access is confirmed, you can continue into the complete practice exam from this quiz flow.

Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.

Keep studying

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

About this Exam

Additional Information

HTB CWEE Practice Questions - HTB Certified Web Exploitation Expert Exam

Frequently Asked Questions

Related Questions

ISC2 Certified in Cybersecurity Practice Exam

Arizona CNA Certified Nursing Assistant Practice Exam

Certified Professional Public Buyer (CPPB) Practice Exam

Certified Specialist Business Intelligence (CSBI) Practice Test

Certified Specialist In Renal Nutrition (CSR) Practice Exam

Certified Specialist Physician Practice Management (CSPPM) Practice Exam