Manipulating Network Traffic GMOB Practice Questions (Page 6)

Questions 26–26

1. 26application · medium

   During a mobile app security assessment, an analyst captures a login request and notices the session token is transmitted in a custom HTTP header. The analyst wants to test whether the server properly validates the session token on subsequent API calls. Which technique should the analyst use to test for improper session validation?

   • ARemove the session token header entirely and observe if the server allows access.
   • BChange the HTTP method from POST to GET and resend the request.
   • CModify the session token to an arbitrary value and observe if the server returns an error.
   • DReplay the captured request with the same session token after logging out and observe if the server still accepts it.
   Reveal Solution Discussion Select an answer first