Authentication Bypass WAHS Practice Questions (Page 12)

Questions 56–60

1. 56application · medium

   A web application has an admin panel at /admin, but the link to it is only visible to users with the admin role. A regular user discovers the URL by guessing and accesses the admin panel without any authorization error. Which two vulnerabilities are being exploited?

   • AClient-side validation bypass and response manipulation
   • BForced browsing and missing function-level access control
   • CIDOR and parameter manipulation
   • DSession token prediction and cookie replay
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   What is authentication bypass via response manipulation?

   • AUsing a proxy to hide the IP address
   • BEncrypting the response data
   • CModifying the client's request headers
   • DModifying the server's response (e.g., changing 'false' to 'true') to trick the application into granting access
   Reveal Solution Discussion Select an answer first
4. 58expert · hard

   A web application has a role-based access control (RBAC) system. The admin panel is at /admin, and the server checks the user's role for GET requests. However, the server does not check the role for POST requests to /admin. An attacker with a 'user' role wants to create a new admin user. What is the most likely attack?

   • ASend a POST request to /admin with the payload to create a new admin user.
   • BUse a GET request to /admin and hope the server processes it as a POST.
   • CExploit a race condition by sending multiple POST requests simultaneously.
   • DModify the client-side JavaScript to add an admin button.
   Reveal Solution Discussion Select an answer first
5. 59foundation · easy

   How can an attacker exploit a race condition in session creation?

   • ABy sending multiple login requests simultaneously to create multiple sessions with the same token
   • BBy using a different browser
   • CBy using a stronger password
   • DBy clearing the browser cache
   Reveal Solution Discussion Select an answer first
6. 60application · medium

   A web application allows login via Google OAuth. The application stores the OAuth token in a cookie and uses it to authenticate API requests. The cookie is not marked Secure and the application does not validate the token's audience. What is the most critical risk?

   • AThe token can be replayed after the user logs out.
   • BAn attacker can steal the token over HTTP and use it to access the user's Google account.
   • CThe token can be brute-forced because it is stored in a cookie.
   • DThe token can be predicted because it is generated by Google.
   Reveal Solution Discussion Select an answer first