API and Webhook Hacking CEH Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A CRM system uses webhooks to sync contact information from a third-party marketing platform. The webhook endpoint parses the 'email' field and inserts it into a SQL database without sanitization. An attacker discovers they can send a webhook with a crafted 'email' value that causes the database to execute an unintended SQL command. Which of the following is the most effective defense?

   • AValidate that the email field matches a standard email regex before processing.
   • BLimit the length of the email field to 254 characters.
   • CUse parameterized SQL queries when inserting the email value into the database.
   • DVerify the webhook signature before parsing the payload.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A developer creates a user profile update endpoint that accepts a JSON object and directly binds it to a User model. The model has fields: username, email, password, and isAdmin. A tester sends a PUT request with the body {"username":"newuser","email":"a@b.com","isAdmin":true} and the response shows the user now has administrator privileges. Which vulnerability is this, and what is the best fix?

   • ABroken object-level authorization; check that the user owns the profile being updated
   • BSecurity misconfiguration; disable the PUT method and use POST instead
   • CMass assignment; use an allowlist of fields that the client is permitted to update
   • DInsecure direct object reference; use random IDs instead of sequential ones
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A webhook endpoint receives JSON payloads from a payment provider. The payload contains a 'callback_url' field that the application uses to send a confirmation request. A tester modifies the callback_url to point to an internal server and observes that the application sends the confirmation to that internal address. Which vulnerability is this, and what is the best mitigation?

   • AMass assignment; remove the callback_url field from the payload
   • BServer-side request forgery (SSRF) via webhook data injection; validate and allowlist the callback_url domain
   • CReplay attack; add a timestamp and nonce to the payload
   • DCommand injection; sanitize the callback_url to remove shell metacharacters
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A developer is building a webhook receiver that processes JSON payloads from a CRM. The payload contains a 'user' object with fields 'name' and 'email'. The receiver deserializes the JSON directly into a User object and then saves it to the database. A tester sends a payload with an extra field 'isAdmin': true and observes that the user is created with admin privileges. The developer needs to fix this without breaking the ability to receive new legitimate fields in the future. Which approach is best?

   • AAdd a blacklist of sensitive fields such as 'isAdmin' to the deserializer
   • BUse a DTO that explicitly defines the allowed fields and map it to the User object
   • CDisable the webhook endpoint and use a polling mechanism instead
   • DUse a dynamic object and manually copy only the known fields
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company operates a webhook endpoint that receives order updates from multiple partners. Each partner has a unique shared secret. The endpoint currently verifies the HMAC signature of each request. However, an attacker has obtained one partner's secret and is replaying old, valid requests to cause duplicate order processing. The company wants to prevent replay attacks without breaking legitimate retries from partners. Which approach is most effective?

   • AIncrease the allowed time window to 24 hours to accommodate network delays
   • BRequire partners to send a new HMAC secret for every request
   • CUse a nonce that is generated by the receiver and sent to the partner before each request
   • DInclude a timestamp in the payload and reject requests older than a small window, while also storing a cache of recently seen webhook IDs
   Reveal Solution Discussion Select an answer first