Authentication Bypass WAHS Practice Questions (Page 14)

Questions 66–70

1. 66foundation · easy

   How can SQL injection be used to bypass authentication?

   • ABy injecting a payload that makes the login query always return true
   • BBy sending a specially crafted email to the user
   • CBy brute-forcing the password field
   • DBy using a proxy to modify HTTP requests
   Reveal Solution Discussion Select an answer first
2. 67application · medium

   A web application's password reset feature sends a reset link to the user's email. The link contains a token that is generated using the current timestamp and the user's email address, then encoded in base64. An attacker who knows the victim's email address and the approximate time of the reset request can predict the token. Which two weaknesses are present in this implementation?

   • AVerbose error messages and session fixation
   • BInsecure direct object reference and missing rate limiting
   • CWeak password policy and lack of account lockout
   • DPredictable token generation and weak entropy
   Reveal Solution Discussion Select an answer first
4. 68expert · hard

   A web application allows users to upload profile pictures. The application checks the file extension and MIME type but does not check the file content. An attacker uploads a PHP file disguised as an image, and the server executes it when accessed via a direct URL. The uploaded file is stored in a directory that is accessible without authentication. Which two vulnerabilities are being exploited?

   • ASession token prediction and cookie replay
   • BClient-side validation bypass and response manipulation
   • CUnrestricted file upload and unsecured file access
   • DIDOR and forced browsing
   Reveal Solution Discussion Select an answer first
5. 69application · medium

   A login form returns different error messages: 'Invalid username' vs 'Invalid password'. The backend constructs a SQL query by concatenating the username and password directly. Which attack is most directly enabled by these two flaws combined?

   • ASession token prediction, because the error messages leak session state.
   • BPassword reset token brute-force, because the login form is weak.
   • CSQL injection to bypass authentication, because the query is vulnerable and error messages reveal valid usernames.
   • DClient-side authentication bypass, because the error messages are shown in the browser.
   Reveal Solution Discussion Select an answer first
6. 70application · medium

   A login form returns 'User not found' for unknown usernames and 'Incorrect password' for known usernames. An attacker can use this to enumerate valid usernames. Which additional vulnerability would make this enumeration most dangerous?

   • AThe login form is vulnerable to SQL injection.
   • BThe session cookie is not marked HttpOnly.
   • CThe application uses HTTP instead of HTTPS.
   • DThe password reset token is sent via email.
   Reveal Solution Discussion Select an answer first