Parameter Tampering WAHS Practice Questions (Page 9)

Questions 41–43

1. 41foundation · easy

   Which of the following best describes the root cause that makes parameter tampering possible?

   • AThe client uses HTTPS to encrypt all communication with the server.
   • BThe client-side JavaScript performs all input validation before submission.
   • CThe server stores all application data in a single database table.
   • DThe server relies on client-supplied parameters without sufficient validation or integrity checks.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A web application allows users to set a 'language' parameter in the URL to change the interface language. An attacker changes the 'language' parameter to a very long string and causes the application to crash. What is the primary vulnerability being exploited?

   • ASQL injection, because the long string is used in a database query
   • BCross-site scripting, because the long string is reflected in the page
   • CDenial of service, because the attacker is sending many requests
   • DParameter tampering, because the server does not validate the length of the parameter
   Reveal Solution Discussion Select an answer first
3. 43application · medium

   An attacker is testing a web application that allows users to view their invoices. The URL is: https://example.com/invoice?id=12345. The attacker changes the 'id' to 12346 and views another user's invoice. This is an example of which type of vulnerability?

   • ASession fixation because the attacker is using a fixed session ID
   • BCross-site scripting because the invoice is displayed to the user
   • CParameter tampering leading to unauthorized data access
   • DSQL injection because the 'id' parameter is used in a database query
   Reveal Solution Discussion Select an answer first