Free OffSec OSWA Exam Questions

Become OffSec Certified with updated OSWA exam questions and correct answers

Page: 1 / 36

Total 180 Questions | Updated On: Apr 28, 2026

Add To Cart

Question 1

During a penetration test, you find a reflected XSS in a GET parameter ?q=. The web app sets a HttpOnly session cookie. Which of the following BEST allows you to hijack the victim’s authenticated session?

A : Steal cookies with document.cookie

B : Inject JS to perform CSRF requests using victim’s session

C :

D : Bruteforce the session token using ffuf

Answer: B

Question 2

Developer says “we sanitize server output.” You suspect a DOM sink. Which minimal probe best surfaces a client-side sink without server reflection?

A :

B :

C :

D :

Answer: C

Question 3

You want to enumerate hidden admin panels on https://corp.example/ while avoiding common noise. Requirements:Ignore responses with status codes 302 and 403.Match only responses containing “Admin” or “Control Panel” (case-insensitive).Randomize User-Agent each request from ua.txt.Throttle requests to bypass rate-limiting.Which ffuf command lines satisfy all requirements? (Select all that apply)

A : ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u https://corp.example/FUZZ \-H "User-Agent: $(shuf -n1 ua.txt)" -fc 302,403 -mr "(?i)(Admin|Control Panel)" -p 0.2

B : ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u https://corp.example/FUZZ \-H "User-Agent: Mozilla/5.0" -fc 403 -mr "Admin|Control Panel" -p 0.2

C : ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u https://corp.example/FUZZ \-H "User-Agent: $(shuf -n1 ua.txt)" -fc 302,403 -mr "(?i)(Admin|Control Panel)" -p 0.3

D : ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u https://corp.example/FUZZ \-H "User-Agent: fuzz" -fc 302,403 -mr "Admin" -t 50

E : ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u https://corp.example/FUZZ \-H "User-Agent: $(shuf -n1 ua.txt)" -fc 302,403 -mr "(?i)(Admin|Control Panel)" -t 100

Answer: C

Question 4

You gain SELECT access via SQLi on MySQL. You want SUPER privileges.What technique applies?

A : Exploit INTO OUTFILE to drop reverse shell

B : Abuse SET GLOBAL general_log_file + write webshell

C : Elevate using UNION SELECT grant_option_priv

D : Modify mysql.user directly with injected UPDATE

Answer: D

Question 5

A WAF blocks single quotes '. Which payload bypasses it to fetch database()?

A : 0x61646d696e AND database()=0x61646d696e

B : AND database()=HEX('admin')

C : AND database()=0x61646d696e

D : UNION SELECT 0x61646d696e

Answer: C

Page: 1 / 36

Total 180 Questions | Updated On: Apr 28, 2026

Add To Cart