API and Java Web Token Penetration Testing CPENT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a JWT none algorithm attack, what does the attacker set the 'alg' header to?

   • ARS256
   • Bnone
   • CHS256
   • DAES256
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary requirement for cracking a JWT secret offline?

   • AThe server's public key
   • BA captured JWT that uses a symmetric signing algorithm like HS256
   • CThe user's password
   • DThe server's private key
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   You are analyzing a JWT captured from an API. The token has the following header: {"alg":"HS256"}. The payload includes "iss":"https://auth.example.com", "exp":1600000000, "sub":"user123". You suspect the token is vulnerable to a weak secret. Which action is most appropriate to confirm this?

   • AChange the 'exp' claim to a far-future date and re-encode the token without changing the signature.
   • BTry to use the token with a different 'iss' claim to see if the API accepts it.
   • CSend the token to the API with the 'alg' header changed to 'none'.
   • DUse a tool like hashcat with the token and a wordlist of common secrets to brute-force the HMAC secret.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During an API assessment, you notice that the API returns detailed stack traces in error responses. This is an example of which security misconfiguration?

   • AImproper error handling that exposes sensitive information to clients.
   • BExcessive data exposure where the API returns more fields than necessary.
   • CInsecure default configuration that allows directory listing.
   • DMissing rate limiting that allows unlimited requests.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In a JSON Web Token (JWT), which part is Base64Url-encoded and contains the signing algorithm and token type?

   • ASignature
   • BEncryption key
   • CHeader
   • DPayload
   Reveal Solution Discussion Select an answer first