Practice English vocabulary for web application penetration testing: OWASP Top 10, SQL injection, XSS, CSRF, IDOR, and reporting findings.
0 / 10 completed
1 / 10
The pentester used the industry-standard list of the 10 most critical web security risks to structure their test. Which phrase is correct?
'OWASP Top 10 as the test checklist' means using the Open Web Application Security Project's list of the 10 most critical web application security risks as the scope guide for the test.
2 / 10
The tester injected malicious SQL code into a login form and was able to retrieve all records from the users table. Which phrase is correct?
'The SQL injection allows data extraction' describes a critical vulnerability where an attacker can run arbitrary SQL queries through unsanitized input fields, exposing database contents.
3 / 10
The tester inserted JavaScript code into a comment field, and when another user viewed the comment, the script ran in their browser. Which phrase is correct?
'The XSS payload executes in the victim's browser' describes a Cross-Site Scripting attack where malicious JavaScript is stored and later executed in the context of another user's browser session.
4 / 10
The tester found that a sensitive action (deleting an account) can be triggered by a link clicked by a logged-in user, with no anti-forgery token present. Which phrase is correct?
'CSRF token is missing on the form submission' identifies a Cross-Site Request Forgery vulnerability. A CSRF token is a random value that proves the request originated from the legitimate application, not a malicious third-party site.
5 / 10
The tester found that changing a user ID in the API request URL returned another user's private data. Which vulnerability is this?
'IDOR' stands for Insecure Direct Object Reference — a vulnerability where an API uses predictable identifiers (like user IDs) without checking if the requester is authorized to access that resource.
6 / 10
During a code review of a user profile update endpoint, Alice comments: 'I'm seeing a potential XSS vulnerability here. The input isn't properly sanitized before being used in the HTML response.' Which term best describes what Alice is identifying?
Alice's observation relates to XSS – Cross-Site Scripting. This occurs when untrusted data is directly inserted into HTML without proper sanitization, potentially allowing attackers to inject malicious JavaScript code. CSRF and Race Conditions are different attack vectors; SQL Injection focuses on manipulating database queries.
7 / 10
In a Slack message from the pentester to the development team, they write: 'We've discovered that a crafted request can bypass authentication checks on the admin panel. Specifically, manipulating the HTTP User-Agent header seems to be the key.' What vulnerability is being described?
This describes Broken Authentication – a critical flaw where authentication mechanisms are bypassed. The User-Agent header manipulation is a common technique used to trick the server into treating the request as if it originates from a trusted source, allowing unauthorized access. Parameter Tampering and SSRF involve different attack vectors.
8 / 10
The tester is analyzing the response from an API endpoint responsible for retrieving user data. The API returns a JSON payload containing sensitive information like credit card numbers and social security details for all users, even those who haven't explicitly requested this data. Which vulnerability best explains this situation?
This is an Information Disclosure vulnerability – a serious flaw where sensitive data is exposed to unauthorized users. This typically happens due to insufficient access controls or improper handling of data during API design. DoS and Session Hijacking relate to disrupting service or stealing user sessions, while Broken Object Level Authorization deals with incorrect permissions on individual objects.
9 / 10
During a standup meeting, the pentester reports: 'I've identified a vulnerability where a maliciously crafted URL parameter can trigger an infinite loop in the application logic, leading to a denial of service.' What type of attack is this?
This describes Resource Exhaustion – a denial of service attack that consumes system resources like CPU or memory. Specifically, the attacker is exploiting a logic flaw to trigger an infinite loop and overload the server. SQL Injection attempts to manipulate database queries; XSS injects scripts into web pages.
10 / 10
A developer is reviewing a PR that implements a new feature: a user profile editing page. The PR description states: 'This allows users to update their name and email address.' However, the code doesn't include any input validation or sanitization before using this data in database queries. What security risk does this represent?
This describes SQL Injection – a vulnerability where malicious SQL code is inserted into database queries. The lack of input validation allows the attacker to control the query, potentially leading to data breaches or unauthorized access. XSS involves injecting scripts, while Authentication Bypass and Privilege Escalation relate to different types of security flaws.
What will I practise in "Web Application Pentest Vocabulary"?
This module focuses on Pentest Communication — real workplace phrasing you'll use on the job. It contains 10 scenario-based multiple-choice questions with instant feedback.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account or sign-up required.
How many questions does this exercise have?
This module includes 10 questions. Each one gives an immediate right/wrong result plus a full explanation of the correct phrasing.
What happens if I answer a question incorrectly?
You'll see the correct answer highlighted straight away, along with a plain-English explanation of why it's right and why the other options don't fit — mistakes are part of the learning here.
Can I retry the exercise if I want a better score?
Yes — use the 'Try again' button on the results screen to reset your score and go through the questions again. There's no limit on attempts.
Who is this Pentest Communication exercise for?
It's aimed at IT professionals with working English who want to sound more natural and precise around pentest communication — useful whether you're preparing for real conversations at work or just building confidence with the vocabulary.
Do I need an account to track my progress?
No account is needed. Your progress through the exercise is tracked locally in your browser for the current session, and you can replay the module at any time.
How is this different from reading a blog article?
This exercise is an interactive drill that tests and reinforces specific phrasing through multiple-choice questions with instant feedback, while blog articles explain concepts and vocabulary in prose. The two work well together.
Where can I find more Pentest Communication exercises?
See the Pentest Communication hub for more modules like this one, or browse the full Exercises page for other IT-English topics.
Can I complete this exercise on my phone?
Yes — every exercise on CoderSlingo is fully responsive and works on phones and tablets, so you can practise anywhere.