Authentication Bypass WAHS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A password reset link contains a token that is generated using the user's email address and a fixed secret key. The token does not expire. What is the most likely attack?

   • ABrute-force the token because it is short.
   • BPerform a race condition attack on the reset endpoint.
   • CPredict the token by knowing the email and the fixed secret.
   • DReplay the token after it has been used.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How can an attacker exploit client-side scripts to bypass authentication?

   • ABy disabling cookies
   • BBy using a different browser
   • CBy clearing the browser cache
   • DBy modifying the JavaScript code that checks authentication before it runs in the browser
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A web application uses JavaScript to disable the submit button on a login form until the user enters a valid email format. A penetration tester uses a proxy to intercept the request and modifies the email parameter to an invalid format, then forwards it to the server. The server accepts the request and logs the tester in. Which vulnerability is being exploited?

   • AResponse manipulation to alter the server response
   • BClient-side validation bypass
   • CHTTP method tampering to use PUT instead of POST
   • DParameter manipulation to change the email
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A mobile application communicates with a backend API. The API has an endpoint /api/user/profile that returns user data. The mobile app includes a token in the Authorization header, but the API also accepts requests without any token if the request comes from a certain IP range. An attacker discovers this and accesses other users' profiles by changing the user_id parameter. Which two vulnerabilities are present?

   • AClient-side authentication bypass and parameter pollution
   • BForced browsing and HTTP method tampering
   • CUnsecured API endpoint and IDOR
   • DWeak session token and cookie replay
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A web application uses OAuth 2.0 with a third-party provider for login. The application only verifies that the OAuth response contains an email address, but does not verify the token's signature or issuer. What is the most likely attack?

   • ABrute-force the OAuth authorization code.
   • BSteal the OAuth token via a phishing page.
   • CForge an OAuth response with an arbitrary email to impersonate any user.
   • DPerform a replay attack on the OAuth token.
   Reveal Solution Discussion Select an answer first