Web Application Authentication Attacks GWAPT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A penetration tester is testing a password reset feature. The application sends a reset link to the user's email, but the link contains a token that is the user's email address encoded in base64. Which flaw is most directly present?

   • APredictable reset token
   • BRace condition in the reset process
   • CUser enumeration via error messages
   • DSession fixation
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A web application has a login endpoint that uses a JSON body with 'username' and 'password' fields. The application checks the username and password against a database and then sets a session cookie. A penetration tester finds that if they send a request with a very large password (e.g., 100,000 characters), the application returns a 500 error. Which of the following is the most likely vulnerability?

   • AThe application is vulnerable to session fixation because the session cookie is not regenerated after login.
   • BThe application is vulnerable to race conditions because the password is processed asynchronously.
   • CThe application does not limit the size of input, leading to a denial-of-service condition.
   • DThe application is vulnerable to SQL injection because the password is not parameterized.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A web application uses multi-factor authentication (MFA) where the second factor is a one-time password (OTP) generated by a mobile app. A penetration tester discovers that the OTP verification endpoint does not check whether the OTP has already been used. Which of the following attacks is most directly enabled by this flaw?

   • APhishing attack, where the user is tricked into providing the OTP.
   • BSession fixation, because the OTP can be used to fix the session.
   • CBrute-force attack, because the OTP space is small.
   • DReplay attack, where an intercepted OTP can be reused to authenticate multiple times.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A penetration tester is assessing a web application that uses a single sign-on (SSO) mechanism. The tester wants to test for session-based attacks. Which of the following is the most effective way to test for session fixation?

   • AAnalyze the session cookie's entropy using a statistical tool.
   • BSet a known session cookie before logging in and check if the same cookie is used after authentication.
   • CAttempt to guess the session ID by brute-forcing the cookie value.
   • DIntercept the session cookie and replay it from a different browser.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which technique is commonly used to bypass SMS-based multi-factor authentication?

   • ASQL injection
   • BSession fixation
   • CSIM swapping
   • DDNS rebinding
   Reveal Solution Discussion Select an answer first