Web Application Authentication Attacks GWAPT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A web application's password reset process uses a token that is sent to the user's email. The token is a 32-character hexadecimal string. The application stores the token in the database and also sends it in the reset link. A penetration tester has access to the application's database and finds that the token is stored in plaintext. Which of the following is the most significant risk?

   • AThe token is predictable because it is generated using a weak random number generator.
   • BThe token is vulnerable to interception because it is sent via email.
   • CAn attacker with database access can directly use a valid reset token to reset any user's password.
   • DThe token can be brute-forced because it is only 32 characters long.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which attack vector involves an attacker using a list of previously breached username/password pairs to attempt authentication against a web application?

   • APhishing
   • BCredential stuffing
   • CBrute force
   • DSession fixation
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a common weakness of push-notification-based multi-factor authentication that attackers exploit?

   • APredicting the notification ID
   • BMFA fatigue attacks
   • CIntercepting the notification via network sniffing
   • DBrute forcing the push notification payload
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A web application's password reset process asks the user to provide their email address and then sends a reset link. The application responds with 'If that email exists, a reset link has been sent.' However, the response time differs significantly between valid and invalid email addresses. What vulnerability does this indicate?

   • ASession fixation, because the reset process does not regenerate the session ID.
   • BUser enumeration, because the response time reveals whether the email address is registered.
   • CRace condition, because the reset link can be used multiple times.
   • DPassword reset token prediction, because the token is generated based on the email address.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A penetration tester is using Burp Suite to test a web application's login functionality. The tester wants to automate a brute-force attack against the password field while keeping the username constant. Which Burp Suite feature is most appropriate for this task?

   • AIntruder with a Battering Ram attack type, placing payload positions on both username and password.
   • BRepeater with manual modification of the password parameter for each request.
   • CSequencer to analyze the randomness of the password parameter.
   • DIntruder with a Sniper attack type, placing a payload position on the password parameter.
   Reveal Solution Discussion Select an answer first