Exploiting Insecure Web Application References GCIH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A penetration tester is assessing a web application that uses numeric IDs for invoices. The tester wants to determine if the application is vulnerable to IDOR by accessing invoices belonging to other users. Which testing approach is most effective?

   • ALog in with two different user accounts and attempt to access each other's invoice IDs by modifying the ID parameter.
   • BReview the application's source code to identify all database queries that use the ID parameter.
   • CSend a request with a very large ID value to see if the application returns an error.
   • DUse a web vulnerability scanner to automatically test all parameters for SQL injection.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A development team is building a new document management system. They want to prevent both IDOR and path traversal attacks. Which design choice is most effective?

   • AUse a CDN to serve all documents and assume the CDN's access controls are sufficient.
   • BUse indirect references (e.g., random tokens) for documents and store files in a database with server-side authorization checks.
   • CUse sequential numeric IDs for documents and rely on the web server's access logs to detect unauthorized access.
   • DStore files on the filesystem with user-supplied filenames and rely on URL encoding to prevent traversal.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A web application allows users to transfer money using a form with a hidden field 'recipient_account'. An attacker changes this field to another user's account number and submits the form. What is the primary vulnerability?

   • AThe application trusts client-supplied parameters for critical operations
   • BThe application uses a hidden field instead of a visible field
   • CThe application does not use CAPTCHA
   • DThe application does not use HTTPS
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is reviewing logs and notices that a user is accessing the admin panel by adding the parameter ?admin=true to the URL. The application checks this parameter to enable admin features. Which of the following is the best immediate action to stop this access control bypass?

   • AModify the application to ignore the admin parameter and rely on server-side session roles for authorization.
   • BChange the parameter name to isAdmin and require the value 'yes'.
   • CAdd a rule to the web application firewall to strip the admin parameter from all requests.
   • DBlock the specific user's IP address in the web application firewall.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A web application has multiple vulnerabilities, including IDOR and path traversal. The development team wants to implement a comprehensive fix that addresses both issues with minimal changes to the user interface. Which approach is the most effective?

   • AAdd a WAF rule to block requests containing '..' and any request with a numeric ID.
   • BIntroduce a server-side access control layer that uses indirect references for all object access and validates that any file access stays within a designated root directory.
   • CImplement input validation that only allows alphanumeric characters in all parameters.
   • DUse HTTPS and secure cookies to protect the session.
   Reveal Solution Discussion Select an answer first