API and Java Web Token Penetration Testing CPENT Practice Questions (Page 13)

Questions 61–65

1. 61application · medium

   You are testing a web API that issues JWTs signed with HS256. You have captured a token and suspect the secret is weak. Which approach is most efficient to verify this and forge a valid token?

   • AUse the public key from the server's JWKS endpoint to verify the token and then modify the header.
   • BDecode the token's payload, change the role to 'admin', and re-encode without changing the signature.
   • CSend the token to the API with the alg header changed to 'none' and an empty signature.
   • DRun hashcat with the captured token and a wordlist of common secrets, then use the recovered secret to sign a modified token.
   Reveal Solution Discussion Select an answer first
2. 62foundation · easy

   Which type of injection attack involves sending malicious input that is executed as operating system commands by the API server?

   • ACommand injection
   • BLDAP injection
   • CCross-Site Scripting (XSS)
   • DSQL injection
   Reveal Solution Discussion Select an answer first
4. 63foundation · easy

   Which of the following is a common source for discovering API endpoints during enumeration?

   • AThe client's IP address
   • BThe HTTP response headers only
   • CThe server's DNS records
   • DSwagger/OpenAPI documentation
   Reveal Solution Discussion Select an answer first
5. 64application · medium

   You are testing an API login endpoint. You notice that the API does not limit the number of login attempts. Which attack is most directly enabled?

   • ASQL injection
   • BBrute-force attack on user credentials
   • CJWT algorithm confusion
   • DIDOR
   Reveal Solution Discussion Select an answer first
6. 65application · medium

   You have captured a JWT from an API. The token uses HS256 and you have successfully cracked the secret. Which action allows you to escalate privileges?

   • AModify the payload's 'role' claim to 'admin' and re-sign the token with the cracked secret.
   • BUse the token as-is but add an 'exp' claim far in the future.
   • CSend the token to the API with a different HTTP method.
   • DChange the algorithm header to 'none' and remove the signature.
   Reveal Solution Discussion Select an answer first