API Abuse WAHS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company has an API that manages user profiles. The endpoint GET /api/v2/users/{id} is intended to return public profile information. However, the same endpoint with the HTTP method PUT allows a user to update the profile of any user ID. The API also has a deprecated v1 endpoint that uses GET for updates. During a security test, you find that the v1 endpoint is still active and does not require authentication. Which of the following is the most effective way to mitigate both the verb tampering and the deprecated endpoint risk?

   • ADisable the deprecated v1 endpoint and enforce authorization checks on the PUT method for v2, verifying the user has permission to update the target profile.
   • BAdd rate limiting to the v2 endpoint to slow down potential attacks.
   • CChange the v2 endpoint to use POST for updates and keep the v1 endpoint as is.
   • DRequire a stronger password policy for all users.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's API has a deprecated v1 endpoint /api/v1/admin/export that was used for internal reporting. The endpoint was removed from documentation but is still accessible in production and lacks the new role-based authorization checks that v2 has. An attacker discovers the endpoint through a wordlist and uses it to export sensitive data. What is the most effective remediation?

   • ARedirect all v1 requests to v2
   • BDisable or remove the deprecated v1 endpoint entirely
   • CKeep the endpoint but hide it from documentation
   • DAdd rate limiting to the v1 endpoint
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security architect is designing an API that will be used by multiple third-party applications. The API uses JWT for authentication. The architect wants to ensure that tokens cannot be forged and that the API can verify the token's integrity without relying on a shared secret. Which of the following is the most appropriate approach?

   • AUse RS256 (asymmetric) for signing JWTs and verify the signature using the public key, while also validating the issuer, audience, and expiration.
   • BUse the 'none' algorithm for simplicity and rely on HTTPS to protect the token.
   • CUse HS256 (symmetric) with a strong secret and share the secret with all third-party applications.
   • DUse a custom encoding scheme instead of JWT to avoid known vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which OWASP API Security Top 10 risk is characterized by an attacker accessing objects (e.g., records, files) that belong to other users by manipulating object identifiers in API requests?

   • ASecurity Misconfiguration
   • BUnrestricted Resource Consumption
   • CBroken Function Level Authorization (BFLA)
   • DBroken Object Level Authorization (BOLA)
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the 'algorithm confusion' vulnerability in JWT?

   • AAn attacker tricks the server into using a different algorithm (e.g., 'none' or 'HS256' instead of 'RS256') to verify the token, potentially forging a valid token
   • BAn attacker changes the token expiration time to extend its validity
   • CAn attacker intercepts the token during transmission
   • DAn attacker uses a weak secret to encrypt the token payload
   Reveal Solution Discussion Select an answer first