API and Webhook Hacking CEH Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company exposes a REST API for internal use. The API is protected by an API gateway that enforces authentication. A security assessment reveals that the API returns detailed error messages (e.g., 'SQL syntax error at line 1') and that the gateway allows the TRACE method. An attacker uses the TRACE method to reflect a token stored in a cookie. Which of the following is the most effective remediation?

   • AAdd a WAF rule to block requests containing 'TRACE' in the method.
   • BRequire authentication on the TRACE method.
   • CDisable the TRACE method at the gateway and configure the API to return generic error messages.
   • DUse HTTPS only for the API.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company uses a webhook to receive order status updates from a partner. The webhook endpoint processes the payload and updates the internal database. A tester discovers that the endpoint does not verify any signature and that the payload contains a 'status' field that is directly inserted into a SQL query. Which two vulnerabilities are present?

   • AMissing signature verification and SQL injection
   • BUnauthorized event triggering and command injection
   • CDenial of service and NoSQL injection
   • DReplay attack and mass assignment
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An attacker sends webhook requests with extremely large payloads to a receiver that processes each payload in memory. What is the likely impact?

   • AMass assignment
   • BReplay attack
   • CMemory exhaustion, leading to a denial of service
   • DSQL injection
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During an API assessment, a tester discovers that the server responds to OPTIONS requests with a list of allowed methods including DELETE. The tester sends a DELETE request to /api/v1/users/123 and the account is deleted. The API documentation states that DELETE should only be available to administrators. Which vulnerability is being exploited, and what is the most direct mitigation?

   • ABroken object-level authorization; validate that the user owns the account being deleted
   • BSecurity misconfiguration; restrict the DELETE method to authenticated administrators at the application layer
   • CVerbose error message; suppress the OPTIONS response
   • DRate limiting failure; add a rate limit to the DELETE endpoint
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A webhook endpoint for a CI/CD system accepts a 'repository_url' field and passes it to a shell command to clone the repository. A tester sends a webhook with 'repository_url' set to 'https://example.com/repo.git; cat /etc/passwd'. The endpoint executes the command and returns the file contents. Which of the following is the most effective fix?

   • ASanitize the input by removing semicolons and other shell metacharacters.
   • BRun the webhook processing in a container with limited privileges.
   • CVerify the webhook signature before processing.
   • DUse a library that runs the git clone command without invoking a shell, and validate the URL against an allowlist of known repository hosts.
   Reveal Solution Discussion Select an answer first