Parameter Tampering WAHS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A developer is implementing a file download feature where the filename is passed as a parameter in the URL. Which of the following is the most secure way to handle this parameter to prevent path traversal and unauthorized file access?

   • ASanitize the filename by removing '..' and '/' characters.
   • BUse a regular expression to allow only alphanumeric characters in the filename.
   • CMap the filename to a server-side identifier and use that identifier to look up the actual file path.
   • DStore the file in a public directory and let the web server serve it directly.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A penetration tester is assessing a web application that allows users to view their own invoices. The URL for viewing an invoice is https://example.com/invoice?id=12345. During the assessment, the tester changes the id parameter to 12346 and successfully views another customer's invoice. Which of the following is the most likely root cause of this vulnerability?

   • AThe application does not encrypt the id parameter in transit, allowing an attacker to intercept and modify it.
   • BThe application fails to validate that the id parameter is a numeric value.
   • CThe application relies on the id parameter to identify the resource without verifying that the authenticated user is authorized to access it.
   • DThe application uses a predictable sequential invoice number, making it easy to guess other IDs.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company is migrating a legacy application to a new framework. The legacy application has many parameters that are vulnerable to tampering, including 'price', 'role', and 'userID'. The team wants to implement a comprehensive mitigation strategy. Which approach is the most effective and sustainable?

   • AUse a web application firewall (WAF) to block suspicious requests
   • BUse client-side JavaScript to validate parameters before submission
   • CEncrypt all parameters with a secret key
   • DImplement a centralized input validation library and use server-side sessions for all authorization decisions
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A QA engineer is testing an e-commerce application for parameter tampering vulnerabilities. The engineer wants to check if the 'price' field in a hidden form field can be modified to change the total cost of an order. Which of the following is the most appropriate first step?

   • AReview the client-side JavaScript to see if the price is validated before submission.
   • BUse an intercepting proxy to modify the price parameter in the request and observe whether the server accepts the changed value.
   • CChange the price in the database directly and see if the application reflects the new value.
   • DRun a port scan on the web server to identify open services.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A development team is fixing a parameter tampering vulnerability where users can modify a 'discount' parameter in a request to receive unauthorized discounts. Which of the following is the most effective mitigation?

   • AEncrypt the discount parameter using a symmetric key hardcoded in the client-side code.
   • BAdd a hidden form field with the discount amount and validate it with JavaScript on the client side.
   • CLog all requests that include a discount parameter for later review.
   • DStore the discount amount on the server and never accept it as a client-supplied parameter.
   Reveal Solution Discussion Select an answer first