Exploiting Insecure Web Application References GCIH Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is tasked with assessing a web application that uses sequential order numbers in the URL (e.g., /order?id=5000). The analyst wants to determine if the application is vulnerable to IDOR without causing disruption to legitimate users. Which approach is the most appropriate?

   • AUse a script to iterate through a large range of order IDs and log any that return data.
   • BCheck the web server logs for previous IDOR attempts.
   • CCreate two test accounts, place an order with each, and then attempt to access each other's order by swapping the order IDs.
   • DReview the application source code for authorization checks.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A development team is redesigning a document management system to prevent unauthorized access to files. Currently, users access files via /file?id=123. The team wants to eliminate predictable references while also ensuring that users cannot access files they do not own. Which design change best meets both goals?

   • AReplace the numeric ID with a cryptographically random token and add a server-side authorization check that verifies the user has access to the file.
   • BUse a client-side script to hide the file ID from the URL.
   • CStore files in a public cloud bucket and share links with signed URLs.
   • DKeep the numeric ID but add a CAPTCHA to the file access page.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   An incident response team is investigating a breach where an attacker accessed the admin panel by manipulating the session cookie. The application stores the user's role in the cookie as a plaintext value. The team needs to remediate the vulnerability but also wants to maintain single sign-on (SSO) with an existing identity provider. Which approach is most appropriate?

   • AConfigure the application to derive the user's role from the SSO identity provider's claims and store it only in the server-side session.
   • BAdd a second cookie with a checksum of the role and validate both on the server.
   • CEncrypt the cookie value with a server-side key so that the client cannot read or modify it.
   • DUse a web application firewall to block requests with modified cookies.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   An online banking application allows users to view their account statements via a URL like /statement?account=1001. A user changes the account parameter to 1002 and views another customer's statement. What is the root cause of this vulnerability?

   • AThe application fails to perform proper authorization checks on the requested object
   • BThe application uses a GET request instead of a POST request
   • CThe application does not encrypt the account number in the URL
   • DThe application does not validate that the account number is numeric
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is testing a web application that uses sequential user IDs in the URL (e.g., /profile?id=100). The analyst wants to determine if the application is vulnerable to IDOR. Which of the following actions would best confirm the vulnerability?

   • ALog in as two different users and attempt to access each other's profiles by swapping the ID parameter.
   • BReview the application's robots.txt file for hidden directories.
   • CCheck the web server's TLS configuration for weak ciphers.
   • DRun a port scan on the web server to identify open services.
   Reveal Solution Discussion Select an answer first