A web application allows users to sign in with their Google account using OAuth 2.0. The application uses the 'email' claim from the Google token to identify the user but does not verify that the token was issued for its own client ID. An attacker creates a malicious OAuth application and tricks a victim into authorizing it, then uses the token to log in as the victim. Which two vulnerabilities are being exploited?

Improper validation of the OAuth token's audience and lack of state parameter

Client-side authentication bypass and response manipulation

Weak session token and cookie replay

How can an attacker use HTTP methods to bypass authentication?

By using a proxy to change the HTTP version

By sending a request with a different HTTP method (e.g., POST instead of GET) that the server does not protect

By adding a custom header to the request

What is a common risk associated with default credentials?

Default credentials are always strong and secure

Attackers can easily guess or find default usernames and passwords

Default credentials are automatically changed after first login

Default credentials are unique for each device

What is the most effective defense against SQL injection in authentication?

Using client-side JavaScript validation

Disabling error messages on the login page

Using parameterized queries or prepared statements

Encoding all user input with base64

What is client-side authentication bypass?

Bypassing authentication by using a different browser

Bypassing authentication by disabling cookies

Bypassing authentication by clearing the browser cache

Bypassing authentication checks that are only implemented in the browser (e.g., JavaScript validation)

EC-CouncilWeb Application Hacking and Security

Domain 8Objective 1

Authentication Bypass WAHS Practice Questions (Page 10)

Part of the Authentication and Session Management domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~25–41 in this domain), expect 8–14 from this objective — we provide 75 practice questions to prepare you well beyond it. (estimate)

75questions here

15free pages

20concepts

20 Concepts in This Objective

Authentication Bypass Fundamentals
Direct URL Access and Parameter Manipulation
Session Token Prediction and Hijacking
SQL Injection in Authentication
Weak Password Recovery Mechanisms
Insecure Direct Object References (IDOR)
Forced Browsing and Privilege Escalation
Authentication Bypass via HTTP Methods
Cookie Manipulation and Replay Attacks
Multi-Factor Authentication (MFA) Bypass
Authentication Bypass via API Endpoints
Race Conditions in Authentication
Client-Side Authentication Bypass
Default Credentials and Hardcoded Backdoors
Authentication Bypass via Response Manipulation
Logout and Session Termination Flaws
Authentication Bypass via Error Messages
OAuth and Third-Party Authentication Bypass
Password Reset Token Prediction
Authentication Bypass via File Upload

Questions 46–50

46expert · hard
A web application allows users to sign in with their Google account using OAuth 2.0. The application uses the 'email' claim from the Google token to identify the user but does not verify that the token was issued for its own client ID. An attacker creates a malicious OAuth application and tricks a victim into authorizing it, then uses the token to log in as the victim. Which two vulnerabilities are being exploited?
Select an answer first
47foundation · easy
How can an attacker use HTTP methods to bypass authentication?
Select an answer first
48foundation · easy
What is a common risk associated with default credentials?
Select an answer first
49foundation · easy
What is the most effective defense against SQL injection in authentication?
Select an answer first
50foundation · easy
What is client-side authentication bypass?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.