Exploiting Insecure Web Application References GCIH Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A security architect is designing a new file-sharing service. The service must allow users to share files with specific other users and also support public links for some files. The architect wants to prevent IDOR and path traversal while minimizing the risk of unauthorized access through shared links. Which design is most secure?

   • AUse the file's primary key in the URL and rely on the web server's access logs to detect unauthorized access.
   • BUse a database to store file metadata with a random, unguessable share token for each file, and enforce authorization checks for user-specific shares while allowing public links only for files marked as public.
   • CStore files on the filesystem with user-supplied filenames and rely on the operating system's file permissions.
   • DUse a CDN to serve all files and rely on the CDN's signed URLs for access control.
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A web application allows users to update their profile by submitting a form with a hidden field user_id. A user discovers that changing the user_id field to another user's ID updates that user's profile. The development team wants to fix this without breaking the ability for administrators to edit other users' profiles. Which solution best meets this requirement?

   • AUse a separate form for admins and regular users, with the admin form requiring a special token.
   • BRemove the user_id field from the form entirely and always update the authenticated user's profile.
   • COn the server, ignore the user_id field for non-admin users and use the authenticated user's ID; for admins, validate that they have permission to edit the target user.
   • DAdd a checksum to the user_id field and validate it on the server.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A bug bounty report shows that a file-sharing application allows users to access other users' uploaded files by changing the file ID in the download URL. The application uses a shared storage bucket and stores the file ID as a query parameter. Which of the following is the most effective mitigation?

   • AGenerate a random, unguessable token for each file and use that token in the URL instead of the sequential file ID.
   • BImplement an access control list (ACL) that maps each file ID to the user who uploaded it and check it on every download request.
   • CAdd a timestamp to the download URL and expire it after 5 minutes.
   • DStore files in separate directories named after the user ID and only allow access to the user's own directory.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A mobile banking app uses an API endpoint /api/transactions?accountId=12345 to return transaction history. A security researcher discovers that changing the accountId to another user's account number returns their transactions. The API does not check that the authenticated user owns the account. Which of the following is the most effective fix?

   • AEncrypt the accountId in the request payload.
   • BDerive the accountId from the authenticated session token on the server and ignore any client-supplied accountId.
   • CAdd rate limiting to the API to slow down enumeration attempts.
   • DLog all API requests for auditing purposes.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A file-sharing web app lets users download shared documents via a URL parameter: /download?file=report.pdf. A penetration tester submits /download?file=../../../../etc/passwd and receives the server's password file. Which combination of controls would most effectively prevent this attack while preserving legitimate file downloads?

   • AValidate that the resolved path stays within the designated download directory and reject any request containing traversal sequences.
   • BDisable directory listing on the web server and remove the 'file' parameter from the URL.
   • CUse a blocklist that rejects any parameter value containing '../' or '..\'.
   • DStore files in a database and retrieve them by a numeric primary key instead of a filename.
   Reveal Solution Discussion Select an answer first