Privilege Escalation WAHS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A web application has an admin panel that is only accessible to users with an 'admin' role. A tester finds that by appending '?debug=true' to the admin URL, the application displays debug information and allows the tester to execute administrative functions without the admin role. What is the most likely cause and the best fix?

   • AThe application is vulnerable to CSRF; add anti-CSRF tokens.
   • BThe application has a debug backdoor that bypasses authorization; remove the debug functionality in production and ensure all admin functions are protected by server-side role checks.
   • CThe application is vulnerable to cross-site scripting; sanitize user input.
   • DThe application is vulnerable to SQL injection; use parameterized queries.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A web application has an admin API that allows creating new users. The API checks if the user is authenticated but does not check if the user has the admin role. A regular user discovers they can call this API and create an admin account. What is the most effective fix?

   • ARequire a strong password for new accounts.
   • BAdd a role check to the API endpoint to ensure only admin users can create users.
   • CLog all API requests to detect abuse.
   • DUse a CAPTCHA on the API endpoint.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A web application uses a REST API for all operations. The API uses JWT tokens for authentication. A security audit finds that the JWT token contains a 'role' claim, and the application trusts this claim without verifying it against a server-side source. Which of the following is the most effective mitigation?

   • ARemove the 'role' claim from the JWT and rely on the client to send the role in a header.
   • BUse a longer JWT secret to make it harder to forge tokens.
   • CEncrypt the JWT payload to prevent the client from reading the role.
   • DVerify the JWT signature and, after decoding, check the 'role' claim against a server-side role store or database.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following best defines privilege escalation in a web application context?

   • AThe process of logging user activities to detect unauthorized access attempts.
   • BThe process of encrypting user credentials to prevent unauthorized access to sensitive data.
   • CThe process of authenticating a user by verifying their identity through multiple factors.
   • DThe process of gaining higher levels of access or permissions than originally granted by exploiting vulnerabilities or design flaws.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following techniques is commonly used to exploit horizontal privilege escalation?

   • AExploiting a buffer overflow in the web server to execute arbitrary code.
   • BUsing a brute-force attack to guess the administrator's password.
   • CManipulating object identifiers in requests, such as changing a document ID in a URL.
   • DInjecting SQL code into login forms to bypass authentication.
   Reveal Solution Discussion Select an answer first