API and Webhook Hacking CEH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security tester is evaluating an API that accepts a 'filename' parameter and uses it in a system command to generate a thumbnail: system('convert ' . $filename . ' -resize 100x100 /tmp/out.png'). The tester sends filename=image.png; cat /etc/passwd and the response includes the contents of /etc/passwd. Which vulnerability is this, and what is the most effective fix?

   • ACommand injection; use an allowlist of permitted filenames and avoid shell execution by using a library function
   • BSQL injection; use prepared statements for the command
   • CSecurity misconfiguration; disable the 'convert' command
   • DPath traversal; sanitize the filename to remove '../'
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An API for a document management system uses API keys passed in the 'X-API-Key' header. A security audit finds that the API key is included in the URL query string in some client applications. Which of the following is the most appropriate remediation?

   • ARotate the API key every 30 days.
   • BMove the API key to the 'Authorization' header and enforce that the API rejects requests with the key in the query string.
   • CUse a longer API key (e.g., 256 characters).
   • DEncrypt the API key with a client-side certificate.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A developer is creating a REST API for a blogging platform. The API accepts a JSON payload to create a new post. The Post model has fields: title, body, authorId, published, and views. The developer wants to prevent users from setting the 'views' field or the 'published' field. Which approach is the most secure and maintainable?

   • AUse a Data Transfer Object (DTO) that only includes the fields the client is allowed to set
   • BRename the fields to 'views_' and 'published_' in the database
   • CUse a blacklist to block the 'views' and 'published' fields
   • DRemove the 'views' and 'published' fields from the database schema
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   An API returns detailed stack traces and database error messages to clients. Which security misconfiguration does this represent?

   • AUnnecessary HTTP methods
   • BVerbose error messages
   • CInsecure deserialization
   • DMissing authentication
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is testing a REST API that accepts a JSON payload to search a product catalog. The payload includes a 'category' field that is later used in a MongoDB query. The analyst sends {"category": {"$ne": "nonexistent"}} and receives all products. Which finding should the analyst report, and what is the most effective immediate mitigation?

   • ANoSQL injection; validate that the 'category' field is a string and reject operator keys such as '$ne'
   • BMass assignment; remove the 'category' field from the allowed parameter list
   • CCommand injection; sanitize the input to remove shell metacharacters
   • DSQL injection; parameterize the query using prepared statements
   Reveal Solution Discussion Select an answer first