Parameter Tampering WAHS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A web application uses a custom header 'X-User-Role' to determine the user's role. An attacker discovers that by setting this header to 'admin', they gain administrative privileges. Which of the following is the most appropriate mitigation?

   • AUse the header only for logging purposes
   • BEncrypt the header value with a secret key
   • CValidate the header against a list of allowed roles
   • DIgnore the 'X-User-Role' header and derive the role from the server-side session
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is parameter tampering in the context of web application security?

   • AInjecting malicious SQL code into database queries through user input fields.
   • BIntercepting and altering network traffic between the client and server using a man-in-the-middle attack.
   • COverloading a web server with excessive requests to cause a denial of service.
   • DModifying client-supplied data, such as URL parameters, form fields, or cookies, to alter the application's behavior or access unauthorized resources.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security auditor is reviewing a web application that uses a custom HTTP header 'X-User-Role' to determine the user's role. The auditor suspects that the application trusts this header. Which of the following is the most effective way to test this suspicion?

   • ARemove the header and see if the application still functions.
   • BCheck the server logs to see if the header is being recorded.
   • CUse a browser extension to modify the header and see if the application logs the change.
   • DUse a proxy to add the header 'X-User-Role: admin' to a request and see if the application grants admin privileges.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is using an automated scanner to test a web application for parameter tampering. The scanner reports that the 'step' parameter in a multi-step checkout process can be changed from '1' to '3' to skip payment. What is the most appropriate next step for the analyst?

   • AManually verify the finding by intercepting the request and changing the 'step' parameter
   • BIgnore the finding because automated scanners are unreliable
   • CImmediately report the vulnerability as critical without further testing
   • DChange the 'step' parameter to '4' to see if it skips more steps
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security consultant is reviewing a web application that allows users to transfer money. The consultant notices that the 'fromAccount' parameter in the transfer request is a hidden field. Which of the following is the most likely risk associated with this parameter?

   • AThe hidden field could be used to perform a cross-site scripting (XSS) attack.
   • BThe hidden field could be used to bypass the application's CAPTCHA mechanism.
   • CA user could modify the 'fromAccount' parameter to transfer funds from another user's account.
   • DThe hidden field could be used to inject SQL commands into the database.
   Reveal Solution Discussion Select an answer first