Parameter Tampering WAHS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   How can an attacker use parameter tampering to escalate privileges in a web application?

   • ABy intercepting the server's response and modifying the HTML before it is displayed.
   • BBy changing a 'role' parameter from 'user' to 'admin' in a request that updates the user's profile.
   • CBy flooding the server with requests to exhaust its resources.
   • DBy sending a specially crafted HTTP request to the server's root directory.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A penetration tester is assessing an e-commerce application. While intercepting traffic with Burp Suite, the tester modifies the value of a hidden form field named 'discountCode' from 'WELCOME10' to 'ADMIN50' and observes that the response reflects a 50% discount. The application also accepts a 'userID' parameter in the URL to view order history. Which action best demonstrates the core vulnerability being exploited?

   • AIntercepting the request with Burp Suite to observe the traffic
   • BModifying the 'userID' parameter to access another user's order history
   • CUsing an automated scanner to detect the hidden field
   • DChanging the 'discountCode' field to an unauthorized value that the server trusts without validation
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security tester is reviewing a web application that uses a cookie named 'sessionID' and a separate cookie named 'isAdmin' with value 'false'. The tester changes 'isAdmin' to 'true' and gains admin access. Which of the following is the most likely reason this attack succeeds?

   • AThe server does not use HTTPS
   • BThe 'sessionID' cookie is not encrypted
   • CThe 'isAdmin' cookie is not marked as HttpOnly
   • DThe server uses the 'isAdmin' cookie to make authorization decisions without validating it
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is reviewing a web application that allows users to download files. The URL format is: https://example.com/download?file=report.pdf&user=alice. The analyst suspects that the 'user' parameter can be tampered with to access other users' files. Which parameter is most likely to be tamperable and what is the primary risk?

   • AThe 'file' parameter, because it directly controls which file is served
   • BThe 'user' parameter, because it may control authorization and can be changed to impersonate another user
   • CThe domain name, because it can be changed to redirect to a malicious server
   • DThe 'download' path, because it determines the application endpoint
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   An attacker modifies the 'price' parameter in a shopping cart request from '10.00' to '0.01'. What is the most likely outcome if the application is vulnerable to parameter tampering?

   • AThe application will recalculate the price from the server-side database.
   • BThe application will process the order at the modified price, allowing the attacker to pay less.
   • CThe application will reject the request because the price is not a valid integer.
   • DThe application will automatically log the attacker out for suspicious activity.
   Reveal Solution Discussion Select an answer first