API and Java Web Token Penetration Testing CPENT Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which API authentication method is an open standard for access delegation that allows a user to grant a third-party application limited access to their resources without sharing credentials?

   • AJSON Web Token (JWT)
   • BAPI key
   • COAuth 2.0
   • DHTTP Basic authentication
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the goal of API parameter fuzzing?

   • ATo enumerate all users in the system
   • BTo discover valid API keys
   • CTo test the API's response time
   • DTo send unexpected or malformed values to parameters to trigger errors or vulnerabilities
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   You are testing an API that uses OAuth2 with JWT bearer tokens. You notice that the API accepts tokens with an 'aud' claim that does not match the API's identifier. What is the most likely vulnerability?

   • AThe API fails to validate the audience claim, allowing tokens intended for other services to be used.
   • BThe API is vulnerable to SQL injection in the token validation process.
   • CThe API is using a weak HMAC secret that can be brute-forced.
   • DThe API is vulnerable to a 'none' algorithm attack.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   You are testing an API that uses JWT for authentication. You have a valid token for a low-privileged user. You want to test for IDOR by accessing another user's data. What is the most appropriate test?

   • ASend the request with an expired JWT to see if the API still processes it.
   • BModify the JWT payload's 'role' claim to 'admin' and re-sign it with the same secret.
   • CChange the 'user_id' in the API request to another user's ID while keeping the JWT unchanged, and observe if the API returns that user's data.
   • DUse a different HTTP method (e.g., PUT instead of GET) on the same endpoint.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   In a JWT algorithm confusion attack, what does the attacker use as the HMAC secret when switching from RS256 to HS256?

   • AThe user's password
   • BThe server's public key
   • CA random secret
   • DThe server's private key
   Reveal Solution Discussion Select an answer first