API Abuse WAHS Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   In the OWASP API Security Top 10, which risk involves an attacker being able to call administrative or privileged API functions without the required role?

   • AImproper Inventory Management
   • BBroken Object Level Authorization (BOLA)
   • CBroken Function Level Authorization (BFLA)
   • DUnsafe Consumption of APIs
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   What is HTTP verb tampering?

   • AEncrypting the HTTP request to hide its content
   • BChanging the URL path to access other resources
   • CChanging the HTTP method (e.g., GET to POST) to bypass access controls or access unintended functionality
   • DModifying the HTTP headers to inject malicious content
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A developer is building an API for a project management tool. The endpoint PUT /api/projects/{id} allows users to update project details. The request body is bound directly to the project object. A user discovers they can add the field 'ownerId' to the request body and change the project's owner to themselves, gaining full control of the project. Which of the following is the most appropriate remediation?

   • ARequire the user to include the ownerId in the request body so the server can validate it.
   • BAdd a check in the controller that verifies the user is the project owner before allowing the update.
   • CUse a different HTTP method, such as PATCH, for updates.
   • DUse a Data Transfer Object (DTO) that only includes the fields the user is allowed to update, and map the DTO to the entity.
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   A penetration tester is assessing an API that has both v1 and v2 versions. The v2 admin endpoints require a specific role claim in the JWT. The tester discovers that v1 endpoints are still active and share the same route names, but v1 does not enforce the role claim. The tester also finds that the API gateway routes requests based on the URL path. Which action would most likely allow the tester to access admin functions?

   • AChange the HTTP method from GET to POST on the v2 endpoint
   • BSend the request to the v1 endpoint with the same admin path
   • CAdd an extra parameter to the v2 request to disable the role check
   • DUse a JWT with a different algorithm to bypass signature verification
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A user of a banking app notices that by changing the "accountId" parameter in the request GET /api/v1/transactions?accountId=12345 to another customer's account ID, they can view that customer's transaction history. The API authenticates the user but does not verify that the account belongs to the user. Which two concepts best describe this vulnerability?

   • AMass assignment and BFLA
   • BRate limiting and input validation
   • CJWT tampering and CORS misconfiguration
   • DParameter manipulation and BOLA
   Reveal Solution Discussion Select an answer first