API Abuse WAHS Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A security engineer is reviewing a banking API that allows users to transfer money between accounts. The API endpoint POST /api/transfer takes a JSON body with 'fromAccount', 'toAccount', and 'amount'. The application authenticates the user but does not verify that the 'fromAccount' belongs to the authenticated user. An attacker discovers they can specify any account number as the 'fromAccount' and initiate a transfer. Additionally, the API accepts an optional 'feeWaiver' parameter that, when set to true, waives the transfer fee. Which of the following is the most critical vulnerability and the most appropriate remediation?

   • ABroken Object Level Authorization (BOLA) on the 'fromAccount' parameter; enforce ownership verification before processing the transfer.
   • BMass Assignment on the 'feeWaiver' parameter; remove the parameter from the API or restrict it to authorized roles.
   • CInsufficient Rate Limiting; add rate limiting to prevent multiple transfers.
   • DJWT algorithm confusion; fix the token validation to prevent token forgery.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which of the following is the best defense against parameter manipulation attacks?

   • AUsing HTTPS to encrypt all requests
   • BAdding more parameters to the request
   • CServer-side validation and authorization checks that do not trust client-supplied parameters for sensitive decisions
   • DUsing a WAF to block all requests with 'admin' in the parameter
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A company's API has a login endpoint that is protected by rate limiting (5 attempts per minute per IP). An attacker uses a distributed botnet with thousands of IP addresses to perform a credential stuffing attack, each IP staying under the limit. The attack succeeds because the rate limit is per-IP. Which additional control would most effectively mitigate this distributed brute-force attack?

   • ADisable the login endpoint temporarily
   • BUse only CAPTCHA on the login form
   • CIncrease the per-IP rate limit to allow more attempts
   • DImplement account-based lockout after a small number of failed attempts, regardless of IP
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A developer is fixing a BOLA vulnerability in an API endpoint GET /api/v1/invoices/{invoiceId}. The current code fetches the invoice using the invoiceId from the URL and returns it without checking ownership. The developer proposes two fixes: (1) check that the invoice's customerId matches the authenticated user's ID, or (2) replace the sequential invoiceId with a UUID. Which approach is the most secure and why?

   • AUse UUIDs; they make it impossible for attackers to guess other invoice IDs
   • BBoth are equally secure because UUIDs are unguessable
   • CNeither approach works; the only fix is to disable the endpoint
   • DImplement the ownership check; UUIDs alone do not prevent authorized users from accessing other users' invoices if they obtain the UUID
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   How can insufficient input validation in an API lead to an access control bypass?

   • ABy increasing the rate limit for the API
   • BBy allowing injection attacks (e.g., SQL injection) that modify queries to bypass authorization checks
   • CBy encrypting the request payload
   • DBy enabling CORS to allow cross-origin requests
   Reveal Solution Discussion Select an answer first