Directory Browsing and Bruteforcing WAHS Practice Questions (Page 9)

Questions 41–42

1. 41application · easy

   A security analyst is explaining brute force attack risks to a development team. The team has a login form that currently allows unlimited attempts. The analyst needs to explain the core reason why this is dangerous. Which statement best describes the primary risk of unlimited login attempts?

   • AAn attacker can intercept the login credentials as they travel over the network
   • BAn attacker can systematically try many password combinations until the correct one is found
   • CAn attacker can use the login form to upload malicious files to the server
   • DAn attacker can inject SQL commands through the login form to bypass authentication
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   An attacker finds that the /images directory on a website has directory browsing enabled. Which of the following pieces of information could the attacker most likely obtain from the directory listing?

   • AThe names of image files and possibly other files that have been placed in that directory.
   • BThe plaintext passwords of all registered users.
   • CThe source code of the web application's main application logic.
   • DThe server's operating system version and patch level.
   Reveal Solution Discussion Select an answer first