API Abuse WAHS Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A developer built a REST API that uses JSON Web Tokens (JWTs) for authentication. The server-side code verifies the token's signature using the algorithm specified in the token's header. During a security review, you discover that the server does not restrict which algorithms are accepted. Which of the following attacks is most likely to succeed against this API?

   • AAlgorithm confusion attack, where an attacker forges a token by signing it with the public key using the 'none' algorithm or by switching to HMAC.
   • BToken replay attack, where an attacker captures a valid token and reuses it before it expires.
   • CCross-site scripting (XSS) attack to steal the token from local storage.
   • DBrute-force attack on the token's payload to guess the user ID.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a common JWT vulnerability that can lead to access control bypass?

   • AUsing a weak, guessable secret for HMAC signing
   • BUsing a long, random secret for HMAC signing
   • CExpiring tokens after a short time
   • DUsing HTTPS to transmit tokens
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   An API endpoint is protected by a WAF rule that blocks DELETE requests, but the attacker sends a POST request to the same URL and successfully deletes a resource. Which vulnerability is this?

   • AMass Assignment
   • BJWT Algorithm Confusion
   • CCORS Misconfiguration
   • DHTTP Verb Tampering
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company has an API with multiple versions: /api/v1, /api/v2, and /api/v3. The v1 endpoint is deprecated but still accessible. A security assessment reveals that the v1 endpoint does not enforce the same authorization checks as v2 and v3. Which of the following is the most likely risk and the best mitigation?

   • AAttackers can access the deprecated v1 endpoint to bypass authorization controls; the best mitigation is to disable or remove the deprecated endpoint.
   • BThe v1 endpoint is slower and causes denial of service; the best mitigation is to add a load balancer.
   • CThe v1 endpoint uses an outdated authentication method; the best mitigation is to force users to use v3.
   • DThe v1 endpoint is vulnerable to SQL injection; the best mitigation is to add a WAF.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security engineer is reviewing an API that allows users to upload profile images. The API accepts a filename parameter and uses it in a filesystem path without sanitization. An attacker uploads a file with the name "../../etc/cron.d/backdoor" and the API writes the file outside the intended directory. Which two vulnerabilities are combined in this attack?

   • APath traversal and broken object-level authorization
   • BRate limiting and CORS misconfiguration
   • CMass assignment and JWT confusion
   • DVerb tampering and BFLA
   Reveal Solution Discussion Select an answer first