Privilege Escalation WAHS Practice Questions (Page 8)

Questions 36–39

1. 36foundation · easy

   An attacker is logged into a web application as a regular user. They modify a request parameter that contains a user ID to access another regular user's profile. Which type of privilege escalation is this?

   • ASession fixation
   • BHorizontal privilege escalation
   • CVertical privilege escalation
   • DPrivilege de-escalation
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A user reports that after changing their profile's 'role' parameter from 'user' to 'admin' in a hidden form field, they gained access to the admin dashboard. Which vulnerability is being exploited, and what is the most effective immediate fix?

   • AMissing function-level access control; add client-side JavaScript to hide the admin dashboard link.
   • BInsecure direct object reference; remove the hidden form field from the HTML.
   • CVertical privilege escalation; enforce server-side authorization checks on every request.
   • DHorizontal privilege escalation; enforce server-side authorization checks on every request.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company is designing a new web application and wants to prevent privilege escalation from the start. They are considering using a centralized authorization framework. What is the primary benefit of this approach?

   • AIt eliminates the need for authentication.
   • BIt ensures consistent enforcement of authorization policies across all endpoints.
   • CIt automatically encrypts all user data.
   • DIt speeds up the application by caching authorization decisions.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A web application has a feature that allows users to export their data as a CSV file. The export endpoint is /export?type=users. A penetration tester finds that by changing the type parameter to 'admins', they can export a list of all admin users. The application uses a role-based access control system, but the export endpoint does not check the user's role. Which of the following is the most appropriate fix?

   • AAdd a CAPTCHA to the export endpoint to slow down automated attacks.
   • BRemove the 'type' parameter and create separate endpoints for each data type.
   • CUse a random token in the URL to prevent guessing the 'type' parameter.
   • DAdd a server-side authorization check to the export endpoint that verifies the user has the required role to export the requested data type.
   Reveal Solution Discussion Select an answer first