Free OffSec OSWA Exam Questions

Become OffSec Certified with updated OSWA exam questions and correct answers

Page: 1 / 36

Total 180 Questions | Updated On: Oct 24, 2026

Add To Cart

Question 1

A healthcare portal blocks standard CSRF submissions, but accepts GET requests with sensitive parameters. You need to trick a logged-in doctor into issuing a prescription refill.Which payload works best?

A :

B :

C : Both A and B

D : Neither

Answer: C

Question 2

Developer says “we sanitize server output.” You suspect a DOM sink. Which minimal probe best surfaces a client-side sink without server reflection?

A :

B :

C :

D :

Answer: C

Question 3

During testing, you find a REST endpoint:GET /api/v1/users/1234/profileAuthenticated as a normal user, you can access your own profile. Changing ID 1234 to 1001 retrieves another user’s data. Which methodology most reliably proves mass exploitation feasibility without detection?

A : Burp Intruder brute-forcing all IDs with 200 threads.

B : ffuf sequential fuzzing with -t 1 and rate limiting.

C : Using SQLMap to brute-force numeric IDs.

D : Writing a custom Python script with exponential backoff + anomaly detection bypass.

Answer: D

Question 4

An image thumbnailer service accepts a url and fetches the image server-side. The server runs inside AWS. You can supply gopher:// URIs.Which chain most likely yields temporary AWS credentials that let you enumerate S3 buckets in the same account?

A : Use SSRF to http://169.254.169.254/latest/meta-data/iam/security-credentials/ and then fetch the role name and token.

B : Submit gopher://169.254.169.254:80/_GET%20/... to craft precise TCP requests to metadata endpoint.

C : Use SSRF to query http://metadata.google.internal instead.

D : Use SSRF to initiate a reverse shell back to you.

Answer: B

Question 5

What’s the most reliable exploit?