Web Application Penetration Testing CPENT Practice Questions (Page 12)

Questions 56–60

1. 56application · medium

   You are testing a multi-tenant SaaS application. User A (role: 'user') discovers that by changing the 'role' parameter from 'user' to 'admin' in an HTTP POST request to the profile-update endpoint, they gain administrative privileges. The application also allows User A to access another tenant's data by modifying the 'accountId' parameter in a GET request. Which two vulnerabilities are present, and what is the most appropriate combined remediation?

   • ABroken authentication and session fixation; enforce MFA and rotate session IDs
   • BBusiness logic flaw and SSRF; implement workflow validation and block internal IPs
   • CMass assignment and IDOR; implement server-side role validation and object-level access control checks
   • DSQL injection and CSRF; use parameterized queries and anti-CSRF tokens
   Reveal Solution Discussion Select an answer first
2. 57expert · hard

   You are testing a multi-tenant SaaS application. Each tenant has its own data, and users can belong to multiple tenants. You find that by changing the 'tenant_id' parameter in a request, you can access another tenant's data. The application uses a single database with a tenant_id column for data isolation. Which finding and remediation is most appropriate?

   • AInsecure direct object reference (IDOR) allowing horizontal privilege escalation; remediate by enforcing tenant membership checks on every request
   • BMass assignment vulnerability; remediate by using a whitelist of allowed parameters
   • CBroken authentication; remediate by requiring multi-factor authentication
   • DBusiness logic flaw in the tenant selection; remediate by adding a confirmation step
   Reveal Solution Discussion Select an answer first
4. 58application · medium

   You are testing an online banking application. The 'transfer funds' form does not include an anti-CSRF token, and the application relies solely on cookies for authentication. You want to prove that a logged-in user can be tricked into transferring money to an attacker-controlled account. Which proof-of-concept is most effective?

   • AA request with a custom header to bypass CSRF protection
   • BAn HTML page with a form that auto-submits via JavaScript to the transfer endpoint
   • CA link that the victim clicks to directly open the transfer URL with parameters
   • DAn XMLHttpRequest from the attacker's origin that reads the response
   Reveal Solution Discussion Select an answer first
5. 59expert · hard

   You have found a stored XSS vulnerability in a comment field. The application uses a Content Security Policy (CSP) that restricts scripts to the same origin and blocks inline scripts. However, you notice that the CSP allows 'unsafe-eval' and the application uses a JSONP endpoint that reflects user input. Which technique could you use to execute JavaScript despite the CSP?

   • AUse the JSONP endpoint to load a script from the same origin that contains attacker-controlled data, and leverage 'unsafe-eval' to execute it
   • BUse an inline event handler like onerror to bypass the CSP
   • CUse a data: URI to inject a script
   • DUse a blob: URI to create a script
   Reveal Solution Discussion Select an answer first
6. 60expert · medium

   You are testing a multi-tenant application. User A (role: 'user') discovers that by modifying the 'accountId' parameter in a GET request, they can access another tenant's data. The application also allows User A to change their role by sending a POST request with 'role=admin'. Which two vulnerabilities are present, and what is the most appropriate combined remediation?

   • ABusiness logic flaw and SSRF; implement workflow validation and block internal IPs
   • BIDOR and mass assignment; implement object-level access control and server-side role validation
   • CSQL injection and CSRF; use parameterized queries and anti-CSRF tokens
   • DBroken authentication and session fixation; enforce MFA and rotate session IDs
   Reveal Solution Discussion Select an answer first