A web application restricts access to an administrative panel by only allowing GET requests to /admin. The application does not check the HTTP method for other endpoints. An attacker sends a POST request to /admin/deleteUser with the parameter userID=123 and successfully deletes a user without authentication. Which vulnerability is being exploited?

Forced browsing to guess the admin URL

Insecure HTTP method handling, allowing POST to bypass access controls

Parameter manipulation to change the userID

Client-side authentication bypass by disabling JavaScript

A web application uses URL-based access control. A user with role 'user' can access /dashboard, but the admin panel is at /admin. The application checks the role only on the server-side for /dashboard, but the /admin route is not protected by any middleware. What is the most likely vulnerability and the best remediation?

Session fixation; regenerate the session ID after login.

Insecure Direct Object Reference; implement randomized object IDs for admin resources.

Parameter manipulation; change the role parameter in the URL to 'admin'.

Forced browsing; add server-side authorization checks to the /admin route.

A web application allows users to download invoices by accessing /download?file=invoice_123.pdf. The application checks if the user is logged in but does not check if the user owns the invoice. An attacker changes the file parameter to invoice_124.pdf and downloads another user's invoice. Which two vulnerabilities are being exploited?

Forced browsing and HTTP method tampering

Client-side validation bypass and response manipulation

Session token prediction and cookie replay

Insecure Direct Object Reference (IDOR) and missing authorization check

A web application's login form returns different error messages: 'Invalid username' when the username does not exist and 'Invalid password' when the password is wrong. An attacker uses this information to enumerate valid usernames and then performs a password spraying attack. Which two vulnerabilities are being exploited?

Session fixation and cookie replay

User enumeration via verbose error messages and lack of rate limiting

Parameter manipulation and client-side validation bypass

SQL injection in the login form and weak password policy

What is a common flaw in logout implementation that can be exploited?

The session token is not invalidated on the server after logout

The logout page takes too long to load

The logout button is too small to click

The logout page is not styled with CSS

EC-CouncilWeb Application Hacking and Security

Domain 8Objective 1

Authentication Bypass WAHS Practice Questions (Page 13)

Part of the Authentication and Session Management domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~25–41 in this domain), expect 8–14 from this objective — we provide 75 practice questions to prepare you well beyond it. (estimate)

75questions here

15free pages

20concepts

20 Concepts in This Objective

Authentication Bypass Fundamentals
Direct URL Access and Parameter Manipulation
Session Token Prediction and Hijacking
SQL Injection in Authentication
Weak Password Recovery Mechanisms
Insecure Direct Object References (IDOR)
Forced Browsing and Privilege Escalation
Authentication Bypass via HTTP Methods
Cookie Manipulation and Replay Attacks
Multi-Factor Authentication (MFA) Bypass
Authentication Bypass via API Endpoints
Race Conditions in Authentication
Client-Side Authentication Bypass
Default Credentials and Hardcoded Backdoors
Authentication Bypass via Response Manipulation
Logout and Session Termination Flaws
Authentication Bypass via Error Messages
OAuth and Third-Party Authentication Bypass
Password Reset Token Prediction
Authentication Bypass via File Upload

Questions 61–65

61application · medium
A web application restricts access to an administrative panel by only allowing GET requests to /admin. The application does not check the HTTP method for other endpoints. An attacker sends a POST request to /admin/deleteUser with the parameter userID=123 and successfully deletes a user without authentication. Which vulnerability is being exploited?
Select an answer first
62application · medium
A web application uses URL-based access control. A user with role 'user' can access /dashboard, but the admin panel is at /admin. The application checks the role only on the server-side for /dashboard, but the /admin route is not protected by any middleware. What is the most likely vulnerability and the best remediation?
Select an answer first
63application · medium
A web application allows users to download invoices by accessing /download?file=invoice_123.pdf. The application checks if the user is logged in but does not check if the user owns the invoice. An attacker changes the file parameter to invoice_124.pdf and downloads another user's invoice. Which two vulnerabilities are being exploited?
Select an answer first
64expert · hard
A web application's login form returns different error messages: 'Invalid username' when the username does not exist and 'Invalid password' when the password is wrong. An attacker uses this information to enumerate valid usernames and then performs a password spraying attack. Which two vulnerabilities are being exploited?
Select an answer first
65foundation · easy
What is a common flaw in logout implementation that can be exploited?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Authentication Bypass WAHS Practice Questions (Page 13)

Questions 61–65

What is a common flaw in logout implementation that can be exploited?

Keep studying — Authentication and Session Management