API and Java Web Token Penetration Testing CPENT Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   You are testing an API that allows users to view their own orders. When you change the 'orderId' in the request to another user's order, the API returns that order's details. Which vulnerability is this?

   • ABroken authentication
   • BInjection vulnerability
   • CBroken object-level authorization (IDOR)
   • DSecurity misconfiguration
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a feature of Postman that is useful for API fuzzing?

   • APacket capture
   • BPort scanning
   • CCollection Runner with data files
   • DSQL injection detection
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   You are testing an API that uses JWTs. The server supports both HS256 and RS256. You have obtained the server's public key. Which attack is most likely to succeed if the server does not validate the algorithm?

   • AAlgorithm confusion: sign a token with HS256 using the public key as the secret
   • BUse the public key to verify tokens, but you cannot forge them
   • CNone algorithm: remove the signature
   • DCrack the RS256 private key using hashcat
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   You are testing an API endpoint that accepts a 'search' parameter. You want to test for command injection. Which payload is most appropriate to send?

   • A'; cat /etc/passwd; #
   • BGET /search?search=test
   • C' OR 1=1 --
   • D<script>alert(1)</script>
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the purpose of rate limiting in an API?

   • ATo encrypt all API traffic
   • BTo validate API input
   • CTo limit the number of requests a client can make within a given time period
   • DTo log all API requests
   Reveal Solution Discussion Select an answer first