Web Application Attacks GCPN Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A web application uses a custom authentication mechanism that stores a session token in a cookie. The token is generated using a predictable algorithm based on the user's username and the current timestamp. An attacker has captured a session token for their own account. Which attack is most likely to succeed?

   • ASession prediction: analyze the token generation algorithm and predict other users' tokens.
   • BCSRF: use the captured token to perform actions on behalf of the victim.
   • CBrute-force the session token by trying all possible combinations.
   • DSession fixation: set the victim's session token to a known value.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary characteristic of a CSRF attack?

   • AIt exploits a vulnerability in the server's operating system to gain remote access.
   • BIt intercepts and modifies network traffic between the client and server.
   • CIt tricks the victim's browser into sending unauthorized requests to a web application where the victim is authenticated.
   • DIt injects malicious scripts into the web application's database.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which coding practice is most effective in preventing SQL injection vulnerabilities?

   • AUsing client-side JavaScript validation.
   • BUsing parameterized queries or prepared statements.
   • CValidating input with a blocklist of dangerous keywords.
   • DEncoding output before displaying it.
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A web application uses a session management system that issues a new session cookie after login. The application also has a 'remember me' feature that sets a persistent cookie with a long-lived token. A penetration tester discovers that the 'remember me' token is stored in the database in plaintext. Which of the following attacks is most directly enabled by this finding?

   • AThe attacker can perform a CSRF attack to change the victim's password.
   • BIf the database is compromised, the attacker can use the plaintext tokens to impersonate users.
   • CThe attacker can use the plaintext token to perform session fixation.
   • DThe attacker can predict future session tokens based on the plaintext token.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a common session management flaw that can lead to session hijacking?

   • ARotating session IDs after login.
   • BUsing HttpOnly cookies.
   • CSetting the Secure flag on cookies.
   • DUsing predictable session identifiers.
   Reveal Solution Discussion Select an answer first