API and Java Web Token Penetration Testing CPENT Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   Which JWT attack involves changing the 'alg' header to 'none' to bypass signature verification?

   • ANone algorithm attack
   • BAlgorithm confusion attack
   • CWeak secret brute-forcing
   • DToken replay attack
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   What type of vulnerability occurs when an API uses a user-supplied identifier to access a resource without verifying that the user owns that resource?

   • ASQL injection
   • BInsecure Direct Object Reference (IDOR)
   • CDenial of Service (DoS)
   • DCross-Site Scripting (XSS)
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   You are testing an API that uses RS256 JWTs. You have the public key. You also notice that the server accepts HS256 tokens. Which attack is most likely to allow you to forge an admin token?

   • AModify the payload and keep the original signature
   • BSign a token with HS256 using the public key as the HMAC secret
   • CCrack the RS256 private key using a dictionary attack
   • DUse the none algorithm to remove the signature
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   You captured a JWT that uses HS256. The token's payload contains a claim 'role': 'user'. You want to escalate to 'admin'. Which approach is most likely to succeed?

   • AUse the public key to sign the token with HS256
   • BChange the algorithm to none and set role=admin
   • CBase64-decode the payload and change role to admin without touching the signature
   • DCrack the HMAC secret with hashcat using a wordlist, then forge a token with role=admin
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   You are testing an API that returns user profiles. The API response includes fields like 'internal_id', 'password_hash', and 'credit_card_number' even though the client only needs 'username' and 'email'. Which vulnerability is this?

   • ABroken object-level authorization
   • BSecurity misconfiguration
   • CInjection vulnerability
   • DExcessive data exposure
   Reveal Solution Discussion Select an answer first