Authentication Bypass WAHS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How can an attacker bypass client-side authentication controls?

   • ABy using a faster internet connection
   • BBy using a different keyboard layout
   • CBy using a larger monitor
   • DBy intercepting and modifying the request before it reaches the server
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company uses an internal identity provider (IdP) that supports OAuth 2.0 and enforces MFA. A web application integrates with this IdP for login. The application has a 'remember me' feature that issues a long-lived token. An attacker has stolen a 'remember me' token. Which of the following is the most effective mitigation to prevent the attacker from using the stolen token?

   • AUse a different OAuth flow that does not issue 'remember me' tokens.
   • BBind the 'remember me' token to the user's IP address.
   • CShorten the 'remember me' token expiration to 5 minutes.
   • DImplement token revocation on the IdP and require re-authentication for sensitive actions.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A legacy web application has an administrative account with the username 'admin' and password 'admin123' that was never changed after deployment. The application also allows file uploads to a directory that is accessible via the web root. Which attack chain would give an attacker persistent access?

   • ALog in with default credentials, then upload a web shell to the accessible directory.
   • BPredict the session token, then upload a file to the web root.
   • CUse SQL injection on the login form to bypass authentication, then upload a file.
   • DUpload a malicious file to trigger a race condition in the authentication process.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How can an attacker exploit a flaw in third-party authentication to bypass authentication?

   • ABy clearing the browser cache
   • BBy tricking the application into accepting a forged authentication response from the third party
   • CBy using a different email address
   • DBy using a stronger password for the third-party account
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A web application exposes an API endpoint /api/orders/{orderId} that returns order details. The application uses a session cookie to identify the user, but it does not verify that the order belongs to the logged-in user. An attacker has a valid session and wants to view another user's order. What is the most direct attack?

   • AChange the orderId parameter in the URL to another user's order ID.
   • BExploit a race condition to swap the order ID during the request.
   • CModify the session cookie to impersonate the other user.
   • DUse a different HTTP method like PUT to bypass the ownership check.
   Reveal Solution Discussion Select an answer first