How can an attacker maintain unauthorized access after a user logs out?

By replaying the old session token if it was not invalidated on the server

A password reset feature generates a 4-digit numeric token and sends it via email. The token is valid for 24 hours and the application does not limit the number of reset attempts. An attacker who knows the victim's email can brute-force the token. Which two weaknesses are being exploited?

Weak email security and lack of encryption

Session fixation and cookie replay

Verbose error messages and user enumeration

Low entropy token and lack of rate limiting

A password reset flow sends a 6-digit numeric code to the user's email. The code expires after 10 minutes. The application does not rate-limit attempts. What is the most practical attack to gain access to another user's account?

Replay the reset link after the code is used.

Brute-force the 6-digit code within the 10-minute window.

Predict the code by analyzing the server's random number generator.

Use SQL injection on the reset token field.

What is a cookie replay attack?

Using cookies to store user preferences

Capturing a valid session cookie and reusing it to impersonate the user

Deleting all cookies from the browser

Encrypting cookies to protect them

What is a common vulnerability in OAuth implementations that can lead to authentication bypass?

The application does not validate the 'state' parameter, allowing CSRF attacks

The application uses HTTPS for the OAuth flow

The application uses short-lived access tokens

The application requires user consent for data access

EC-CouncilWeb Application Hacking and Security

Domain 8Objective 1

Authentication Bypass WAHS Practice Questions (Page 15)

Part of the Authentication and Session Management domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~25–41 in this domain), expect 8–14 from this objective — we provide 75 practice questions to prepare you well beyond it. (estimate)

75questions here

15free pages

20concepts

20 Concepts in This Objective

Authentication Bypass Fundamentals
Direct URL Access and Parameter Manipulation
Session Token Prediction and Hijacking
SQL Injection in Authentication
Weak Password Recovery Mechanisms
Insecure Direct Object References (IDOR)
Forced Browsing and Privilege Escalation
Authentication Bypass via HTTP Methods
Cookie Manipulation and Replay Attacks
Multi-Factor Authentication (MFA) Bypass
Authentication Bypass via API Endpoints
Race Conditions in Authentication
Client-Side Authentication Bypass
Default Credentials and Hardcoded Backdoors
Authentication Bypass via Response Manipulation
Logout and Session Termination Flaws
Authentication Bypass via Error Messages
OAuth and Third-Party Authentication Bypass
Password Reset Token Prediction
Authentication Bypass via File Upload

Questions 71–75

71foundation · easy
How can an attacker maintain unauthorized access after a user logs out?
Select an answer first
72expert · hard
A password reset feature generates a 4-digit numeric token and sends it via email. The token is valid for 24 hours and the application does not limit the number of reset attempts. An attacker who knows the victim's email can brute-force the token. Which two weaknesses are being exploited?
Select an answer first
73application · medium
A password reset flow sends a 6-digit numeric code to the user's email. The code expires after 10 minutes. The application does not rate-limit attempts. What is the most practical attack to gain access to another user's account?
Select an answer first
74foundation · easy
What is a cookie replay attack?
Select an answer first
75foundation · easy
What is a common vulnerability in OAuth implementations that can lead to authentication bypass?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.