How can an attacker exploit a weak password recovery mechanism?

By guessing the answers to security questions

By enabling two-factor authentication on the account

By using a stronger password for the account

A web application creates a session after login, but the session ID is generated using the current timestamp and a predictable increment. An attacker knows the approximate time of a victim's login. What is the most effective attack?

Replay a captured session ID from a previous login.

Predict the session ID by generating candidate tokens around the known login time.

Perform a race condition attack by sending multiple login requests simultaneously.

Use session fixation by setting the victim's session ID to a known value.

A user logs out of a web application, but the session cookie remains valid on the server for another 30 minutes. An attacker who has captured the session cookie can still use it to access the user's account. Which two measures should be implemented to mitigate this risk?

Invalidate the session on the server during logout and expire the cookie client-side

Use a shorter session timeout and rotate the session ID periodically

Set the Secure and HttpOnly flags on the session cookie

Implement multi-factor authentication and CAPTCHA on login

An application sets a session cookie with the value 'user=admin; role=user'. The server trusts the cookie's role attribute to determine access. What is the most direct way to escalate privileges?

Replay a previously captured cookie from an admin user.

Perform a session fixation attack by setting the cookie to a known value.

Predict the session ID by analyzing the cookie's timestamp.

Change the cookie value to 'user=admin; role=admin' and replay it.

EC-CouncilWeb Application Hacking and Security

Domain 8Objective 1

Authentication Bypass WAHS Practice Questions (Page 11)

Part of the Authentication and Session Management domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~25–41 in this domain), expect 8–14 from this objective — we provide 75 practice questions to prepare you well beyond it. (estimate)

75questions here

15free pages

20concepts

20 Concepts in This Objective

Authentication Bypass Fundamentals
Direct URL Access and Parameter Manipulation
Session Token Prediction and Hijacking
SQL Injection in Authentication
Weak Password Recovery Mechanisms
Insecure Direct Object References (IDOR)
Forced Browsing and Privilege Escalation
Authentication Bypass via HTTP Methods
Cookie Manipulation and Replay Attacks
Multi-Factor Authentication (MFA) Bypass
Authentication Bypass via API Endpoints
Race Conditions in Authentication
Client-Side Authentication Bypass
Default Credentials and Hardcoded Backdoors
Authentication Bypass via Response Manipulation
Logout and Session Termination Flaws
Authentication Bypass via Error Messages
OAuth and Third-Party Authentication Bypass
Password Reset Token Prediction
Authentication Bypass via File Upload

Questions 51–55

51foundation · easy
Which HTTP method is often used to bypass authentication restrictions that only apply to GET requests?
Select an answer first
52foundation · easy
How can an attacker exploit a weak password recovery mechanism?
Select an answer first
53application · medium
A web application creates a session after login, but the session ID is generated using the current timestamp and a predictable increment. An attacker knows the approximate time of a victim's login. What is the most effective attack?
Select an answer first
54application · medium
A user logs out of a web application, but the session cookie remains valid on the server for another 30 minutes. An attacker who has captured the session cookie can still use it to access the user's account. Which two measures should be implemented to mitigate this risk?
Select an answer first
55application · medium
An application sets a session cookie with the value 'user=admin; role=user'. The server trusts the cookie's role attribute to determine access. What is the most direct way to escalate privileges?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.