Parameter Tampering WAHS Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A web application allows users to update their profile. The request includes a 'userID' parameter that the server uses to determine which profile to update. A user changes the 'userID' to another user's ID and successfully modifies that user's profile. Which mitigation would be most effective in preventing this attack?

   • AValidate that the 'userID' parameter contains only numeric characters
   • BUse the authenticated session's user ID instead of the 'userID' parameter
   • CEncrypt the 'userID' parameter to prevent tampering
   • DAdd a CAPTCHA to the profile update form
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company is developing a new web application and wants to prevent parameter tampering from the start. They are considering several approaches. Which approach is the most secure and maintainable?

   • AEncrypt all parameters with a secret key
   • BUse a web application firewall (WAF) to block suspicious requests
   • CUse client-side JavaScript to validate parameters before submission
   • DImplement server-side validation for all parameters and use server-side sessions for authorization
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security tester is using Burp Suite to test a web application for parameter tampering. The tester intercepts a request that contains a 'step' parameter with the value '1'. The tester changes the value to '999' and forwards the request. The application returns an error message. Which of the following is the most likely conclusion?

   • AThe application validates the 'step' parameter and rejects out-of-range values.
   • BThe application is vulnerable to integer overflow because the value is too large.
   • CThe application is vulnerable to denial of service because the error is caused by the large value.
   • DThe application is vulnerable to parameter tampering because it processes the modified value.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is a manual technique to test for parameter tampering vulnerabilities?

   • ARunning a port scanner to identify open ports on the server.
   • BChecking the server's disk space for unusual files.
   • CUsing a proxy tool like Burp Suite to intercept and modify request parameters before forwarding them to the server.
   • DReviewing the server's firewall logs for suspicious traffic.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A penetration tester is assessing a web application that uses a 'step' parameter to control a multi-step checkout process. The tester changes the 'step' parameter from '2' to '4' and successfully skips the payment step, placing an order without paying. Which of the following is the most effective mitigation for this vulnerability?

   • AUse a CAPTCHA on each step to prevent automated skipping
   • BUse a WAF to block requests with modified 'step' parameters
   • CValidate the 'step' parameter on the server to ensure the user has completed all previous steps
   • DEncrypt the 'step' parameter to prevent tampering
   Reveal Solution Discussion Select an answer first