API and Java Web Token Penetration Testing CPENT Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   You are testing an API that uses JWTs. You have a valid token with the payload {"user":"alice","role":"user"}. The token is signed with HS256. You suspect the secret is weak. Which approach is most efficient to escalate to admin?

   • AUse the public key to sign the token with HS256
   • BChange the algorithm to none and set role=admin
   • CCrack the secret with hashcat using a wordlist, then forge a token with role=admin
   • DModify the payload and keep the original signature
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the first step an attacker typically takes to manipulate a JWT payload?

   • ABrute-force the signature
   • BDecode the token's payload from Base64Url
   • CReplay the token to the server
   • DChange the algorithm to none
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the purpose of using wordlists during API endpoint enumeration?

   • ATo guess valid endpoint paths by brute-forcing common names
   • BTo crack the API key
   • CTo generate random payloads for fuzzing
   • DTo encode the API requests
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   You are assessing an API that uses JWT for authentication. The server uses RS256 for signing. You want to test whether the server is vulnerable to algorithm confusion. What is the key prerequisite for this attack?

   • AObtain the server's public key, which is often available from a JWKS endpoint.
   • BObtain a valid token signed with HS256 from the server.
   • CFind a way to make the server use the 'none' algorithm.
   • DCrack the server's private key using a dictionary attack.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which tool is commonly used to crack weak JWT secrets offline?

   • ABurp Suite
   • Bnmap
   • Chashcat
   • DWireshark
   Reveal Solution Discussion Select an answer first