API and Java Web Token Penetration Testing CPENT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   While testing an API, you find that the server accepts JWTs with the algorithm 'none'. You want to exploit this to access another user's account. What is the most direct way to do this?

   • AEncode a new header with alg=none and a payload with the victim's user ID, then send the token with an empty signature.
   • BUse the victim's token as-is but add an extra claim to the payload.
   • CTake the victim's token and change only the signature to a random value.
   • DDecode the victim's token, swap the alg to HS256, and sign with the public key.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why is it important to analyze the API's functionality before attempting exploitation?

   • ATo obtain permission from the owner
   • BTo avoid crashing the server
   • CTo understand the business logic and identify potential vulnerabilities
   • DTo determine the IP address of the server
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   You are testing an API login endpoint that uses OAuth2 and JWT. You want to assess whether the endpoint is vulnerable to brute-force attacks. Which action is most appropriate?

   • ATry to guess the JWT secret by brute-forcing it with hashcat.
   • BAttempt to use a stolen JWT from another user to access the login endpoint.
   • CSend a series of login requests with different passwords for a known username and monitor for rate limiting or account lockout.
   • DSend a single request with an invalid password to see the error message.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An API uses API keys for authentication. You notice that the API key is a sequential number and that the server does not check if the key is active. Which vulnerability is most directly indicated?

   • APredictable authentication tokens
   • BRate limiting deficiency
   • CInjection vulnerability
   • DBroken object-level authorization (IDOR)
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   You are testing an API login endpoint. The API uses OAuth2 and JWT. You have a list of valid usernames and want to test for credential stuffing. The API has rate limiting that blocks after 5 failed attempts per IP. Which approach is most likely to bypass the rate limit while still testing the vulnerability?

   • AUse a single IP but rotate the User-Agent header for each request.
   • BAttempt to crack the JWT secret instead of brute-forcing the login.
   • CSend all attempts from a single IP but with random delays between requests.
   • DDistribute the login attempts across multiple IP addresses using a proxy or botnet, keeping each IP under the rate limit.
   Reveal Solution Discussion Select an answer first