Web Application Penetration Testing CPENT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A web application uses a JWT-based authentication system. The JWT is stored in a cookie without the HttpOnly flag. You discover that the JWT does not have an expiration time. Which combination of findings represents the most critical security issues?

   • AThe JWT is vulnerable to replay attacks because it is in a cookie
   • BThe JWT can be stolen via XSS and never expires, allowing indefinite account access
   • CThe JWT uses a weak signing algorithm that can be brute-forced
   • DThe JWT is not encrypted, so the payload can be read by an attacker
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   You are testing a banking application. The 'transfer funds' endpoint accepts a POST request with 'amount' and 'toAccount' parameters. The application does not use anti-CSRF tokens. You also notice that the application reflects the 'amount' parameter in the response without encoding. Which attack would be most effective to demonstrate the CSRF vulnerability?

   • ACrafting an HTML page with an auto-submitting form that sends a POST request to the transfer endpoint
   • BInjecting a script into the 'amount' field to steal the session cookie
   • CSending a GET request with the transfer parameters in the URL
   • DUsing a cross-origin fetch request from a malicious site
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common target for business logic testing?

   • AWorkflow steps that can be skipped or reordered
   • BHTTP headers that are not properly sanitized
   • CDatabase connection pool exhaustion
   • DSSL certificate expiration
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   During authentication testing, a penetration tester notices that the application accepts a session ID provided in the URL query string and does not regenerate it after login. Which vulnerability is most likely present?

   • ACross-site request forgery
   • BSession fixation
   • CInsecure direct object reference
   • DBrute-force attack
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   You are testing a web application that allows users to fetch a URL and display its content. The application does not validate or block internal IP addresses. You craft a request to 'http://169.254.169.254/latest/meta-data/' and successfully retrieve the cloud instance metadata. Which vulnerability is present, and what is the most effective remediation?

   • ASSRF; implement an allowlist of permitted URLs and block internal IP ranges
   • BCSRF; add anti-CSRF tokens to the URL fetch request
   • CXSS; encode the URL output and set Content-Type headers
   • DCommand injection; sanitize the URL input and use parameterized commands
   Reveal Solution Discussion Select an answer first