Parameter Tampering WAHS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a common parameter that is susceptible to tampering in a web application?

   • AThe database connection string stored on the server.
   • BThe server's internal configuration file path.
   • CThe server's operating system kernel version.
   • DA hidden form field that stores the product price.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An application uses a hidden field to store the user's role (e.g., 'user' or 'admin'). The development team wants to prevent users from tampering with this field. Which of the following is the most secure approach?

   • AAdd a checksum to the hidden field and verify it on the server.
   • BRemove the hidden field and determine the role from the server-side session.
   • CEncrypt the hidden field value using a secret key stored in the server's configuration.
   • DUse JavaScript to check the role before submitting the form.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which automated tool is commonly used to scan for parameter tampering vulnerabilities?

   • ANmap
   • BMetasploit
   • CWireshark
   • DOWASP ZAP
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A web developer wants to automate the detection of parameter tampering vulnerabilities in a large application with hundreds of endpoints. Which of the following approaches is the most efficient for initial broad coverage?

   • AUse an automated web vulnerability scanner that fuzzes parameters and compares responses for anomalies.
   • BManually inspect each endpoint's source code to identify parameters that are not validated.
   • CUse a network packet analyzer to capture traffic and look for unusual parameter values.
   • DDisable JavaScript in the browser and see if the application still functions correctly.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A penetration tester is assessing a web application that allows users to create and share reports. The application uses a 'reportID' parameter in the URL to view a report. The tester discovers that by changing the 'reportID' to another value, they can view reports belonging to other users. The application also uses a 'debug' parameter that, when set to 'true', displays stack traces. Which of the following is the most appropriate first step to mitigate the identified vulnerability?

   • AUse a random, unguessable reportID to make enumeration harder.
   • BImplement server-side authorization checks to verify that the authenticated user owns the requested report.
   • CDisable the 'debug' parameter in production to prevent information leakage.
   • DAdd a client-side JavaScript check to validate the reportID before submission.
   Reveal Solution Discussion Select an answer first