Authentication Bypass WAHS Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   How can an attacker bypass authentication via API endpoints?

   • ABy using a web browser to access the API documentation
   • BBy sending a request with a valid API key
   • CBy discovering and directly calling API endpoints that lack authentication checks
   • DBy using a different HTTP client
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   How can an attacker manipulate a cookie to bypass authentication?

   • ABy deleting the cookie from the browser
   • BBy setting the cookie's expiration date to a future date
   • CBy changing the value of a cookie that indicates the user's role (e.g., 'admin=true')
   • DBy using a different browser to access the site
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An application uses two-factor authentication (2FA) where the second factor is a 6-digit code sent via SMS. The code is valid for 10 minutes and the application does not limit the number of attempts. An attacker who has stolen the user's password can brute-force the 2FA code. Which two weaknesses are being exploited?

   • ALack of rate limiting on 2FA attempts and a long code validity period
   • BWeak password policy and lack of account lockout
   • CSMS as a delivery method and lack of encryption
   • DSession fixation and cookie replay
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the best practice to prevent information leakage through error messages?

   • ADisplay the stack trace to developers
   • BDisplay the SQL query in the error message
   • CDisplay generic error messages for both invalid username and invalid password
   • DDisplay detailed error messages to help users
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A web application's logout function only deletes the session cookie from the browser but does not invalidate the session on the server. An attacker who has captured a valid session ID can continue to use it. What is the flaw?

   • AImproper session termination because the server-side session is not destroyed.
   • BRace condition because the logout and session deletion are not atomic.
   • CCookie manipulation because the cookie is deleted client-side.
   • DSession fixation because the session ID is not rotated after logout.
   Reveal Solution Discussion Select an answer first