API Abuse WAHS Practice Questions (Page 13)

Questions 61–63

1. 61application · medium

   A REST API endpoint /api/v1/search?q= accepts a search term and directly concatenates it into a SQL query. An attacker submits q=' OR '1'='1 and retrieves all records from the users table, including password hashes. Which two weaknesses are present?

   • AMass assignment and JWT confusion
   • BSQL injection and broken object-level authorization
   • CRate limiting and CORS misconfiguration
   • DVerb tampering and BFLA
   Reveal Solution Discussion Select an answer first
2. 62application · medium

   A web application has an API endpoint that allows users to search for products: GET /api/products?category=electronics. The category parameter is directly inserted into a SQL query without sanitization. An attacker sends the following request: GET /api/products?category=electronics' OR '1'='1. Which of the following is the most likely outcome?

   • AThe attacker can bypass authentication because the injection is in the login form.
   • BThe attacker can modify the product prices because the injection changes the UPDATE statement.
   • CThe attacker can retrieve all products from the database, including those not normally visible, because the SQL query is altered to return all rows.
   • DThe attacker can delete the products table because the injection is executed as a DELETE statement.
   Reveal Solution Discussion Select an answer first
3. 63application · medium

   A financial services API allows unlimited login attempts on its /api/v1/auth/login endpoint. An attacker uses a list of common passwords against a known username and eventually gains access. Which two security controls, if implemented, would most directly mitigate this attack?

   • ARate limiting and account lockout policies
   • BInput validation and output encoding
   • CAPI versioning and deprecated endpoint removal
   • DJWT expiration and CORS restrictions
   Reveal Solution Discussion Select an answer first