Web Application Authentication Attacks GWAPT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A web application uses a session cookie named 'sessionid' that is set to a base64-encoded value. The value decodes to 'user=alice&role=user&expires=2025-12-31'. The application does not regenerate the session ID after login. Which of the following is the most likely vulnerability that can be exploited?

   • AInsecure session token generation, because the session ID is based on user-controlled data.
   • BSession fixation, because the session ID is not regenerated after login, allowing an attacker to set a known session ID.
   • CSession hijacking, because the session ID is predictable and can be guessed by an attacker.
   • DSession expiration, because the session ID contains an explicit expiry timestamp that can be modified by the client.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A web application allows users to change their password by providing the current password, a new password, and a confirmation. The application checks the current password and then updates the password. A tester finds that if they submit the request twice simultaneously, both requests succeed, and the password is changed to the value from the second request. What vulnerability is this?

   • ABroken authentication, because the current password is not checked correctly.
   • BRace condition, because the application does not properly serialize password change requests.
   • CSession fixation, because the session ID is not regenerated after password change.
   • DImproper input validation, because the new password is not validated for strength.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A web application's password reset feature sends a reset link to the user's email. The link contains a token that is generated using the user's email address and the current timestamp, then hashed with MD5. A penetration tester has captured a reset link for their own account. Which of the following is the most likely vulnerability in this implementation?

   • AThe token is stored in the database without hashing, allowing database theft to reveal valid tokens.
   • BThe token is too short, making it vulnerable to brute force.
   • CThe token is predictable because it is based on known data (email and timestamp), allowing an attacker to generate valid tokens for other users.
   • DThe token is transmitted over HTTP, allowing interception.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which mitigation is specifically designed to slow down or block brute force attacks against a login form?

   • AUsing HTTPS for all login requests
   • BImplementing account lockout after a threshold of failed attempts
   • CSetting the HttpOnly flag on session cookies
   • DValidating input length on the username field
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A penetration tester is analyzing a web application's session management. The tester notices that the session ID is generated using a predictable algorithm based on the user's IP address and a timestamp. Which vulnerability is most directly indicated?

   • ASession hijacking via XSS
   • BCredential stuffing
   • CSession fixation
   • DInsecure session token generation
   Reveal Solution Discussion Select an answer first