Authentication Bypass WAHS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A penetration tester is assessing a web application that uses role-based access control. The tester notices that the URL for viewing a user's profile is /profile?user_id=123 and that the application checks the session cookie only on the main dashboard, not on subsequent requests. The tester changes the user_id parameter to 124 and successfully views another user's profile without any authorization error. Which two vulnerabilities are being exploited in this scenario?

   • AInsecure Direct Object References (IDOR) and Missing Function-Level Access Control
   • BCookie Manipulation and Replay Attack
   • CSession Token Prediction and Parameter Pollution
   • DForced Browsing and HTTP Method Tampering
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security engineer is investigating a vulnerability where an attacker can register an account and, by sending multiple concurrent requests to the login endpoint, sometimes gets logged in as a different user. The application uses a shared session pool and does not properly synchronize session creation. Which type of vulnerability is this, and what is the best mitigation?

   • ASession fixation; regenerate session ID after login
   • BSession token prediction; use a stronger random generator
   • CLogout flaw; invalidate sessions on logout
   • DRace condition in session creation; use atomic operations or locks
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst is testing a login form that displays the error message 'Invalid username or password' for incorrect credentials. The analyst submits the following in the username field: 'admin' OR '1'='1' -- and any password. The application logs the analyst in as the admin user. Which vulnerability is being exploited, and what is the most effective remediation?

   • ASQL injection in the authentication query; use parameterized queries
   • BVerbose error messages; implement generic error messages
   • CParameter manipulation; validate and sanitize all inputs
   • DAuthentication bypass via HTTP methods; restrict allowed methods
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security analyst is reviewing a web application that has a 'Remember Me' feature. The feature sets a cookie with the user's username and a hash of the password. An attacker steals this cookie and uses it to authenticate without knowing the password. Which two vulnerabilities are being exploited?

   • ASession fixation and logout flaw
   • BWeak remember-me token design and lack of server-side validation
   • CSQL injection and error message enumeration
   • DClient-side validation bypass and response manipulation
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security consultant is reviewing a web application's session management. The application sets a session cookie with the value 'sessionID=1234567890' and does not rotate the session ID after login. An attacker who can predict the session ID pattern can impersonate a logged-in user. Which two controls should be implemented to mitigate this risk?

   • AUse a long random session ID and store it in a database
   • BSet the Secure flag and implement HTTP Strict Transport Security (HSTS)
   • CImplement a short session timeout and logout functionality
   • DUse a cryptographically random session ID and rotate it after authentication
   Reveal Solution Discussion Select an answer first