API and Webhook Hacking CEH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A webhook receiver is designed to process event notifications from multiple external services. An attacker discovers that the endpoint does not limit the size of the payload and does not require authentication. The attacker sends a large number of oversized payloads simultaneously, causing the receiver to run out of memory and crash. Which two controls would best mitigate this attack?

   • AEnforce a maximum payload size and require authentication or a shared secret for all webhook requests
   • BImplement rate limiting and log all requests
   • CAdd signature verification and use a queue to process events asynchronously
   • DDisable unnecessary HTTP methods and enable compression on responses
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company's webhook endpoint processes events from multiple third-party services. Each event triggers a database write and an external API call. An attacker discovers that the endpoint does not validate the 'event_type' field and sends a large number of 'user.created' events with huge payloads, causing the database to fill up and the external API to be rate-limited. The company wants to mitigate this without blocking legitimate webhooks from trusted services. Which of the following is the most effective combination of controls?

   • AValidate the 'event_type' against an allowlist, enforce a maximum payload size, and implement per-sender rate limiting.
   • BIncrease the database storage capacity and the external API rate limit.
   • CMove the webhook endpoint to a separate server with more resources.
   • DVerify the webhook signature and reject any request that fails verification.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of implementing rate limiting on an API?

   • ATo prevent excessive requests that could exhaust server resources
   • BTo encrypt data in transit
   • CTo authenticate users
   • DTo validate input data
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company's webhook endpoint receives order updates from a supplier. The endpoint verifies the HMAC signature and then updates the order status in the database. A tester finds that by sending a webhook with a valid signature but an 'order_status' field set to 'cancelled', they can cancel an order that has already shipped. The supplier's system does not send 'cancelled' status after shipping. Which of the following is the most effective fix?

   • AVerify the webhook signature with a stronger algorithm (e.g., SHA-512 instead of SHA-256).
   • BLog all webhook payloads for audit purposes.
   • CValidate the 'order_status' value against a state machine that only allows valid transitions (e.g., 'shipped' cannot go to 'cancelled').
   • DRequire the supplier to send a confirmation email before processing the webhook.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A social media app allows users to update their profile via a PUT request to /api/v1/users/{id}. The backend uses a framework that automatically binds all request body fields to the user object. A user discovers they can set 'isAdmin' to true by adding that field to the request body. Which of the following is the most effective remediation?

   • AUse a POST request instead of PUT for profile updates.
   • BDefine a whitelist of allowed fields (e.g., name, email, bio) and bind only those fields to the user object.
   • CRequire the user to send the current password in the request body.
   • DRemove the 'isAdmin' field from the database schema.
   Reveal Solution Discussion Select an answer first