Web Application Authentication Attacks GWAPT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A web application uses multi-factor authentication (MFA) with a time-based one-time password (TOTP) as the second factor. The application has a 'remember this device' feature that sets a long-lived cookie. A penetration tester has obtained the TOTP secret from a previous test. Which of the following is the most effective way to bypass MFA for a target user?

   • AGenerate valid TOTP codes using the obtained secret and use them to authenticate as the target user.
   • BBrute-force the TOTP code by trying all possible values within the time window.
   • CSteal the 'remember this device' cookie from the target user and use it to authenticate.
   • DPerform a phishing attack to obtain the target user's TOTP code.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A penetration tester is performing a credential stuffing attack against a web application. The application uses a Web Application Firewall (WAF) that blocks requests after 5 failed login attempts from the same IP address. The tester has a list of 10,000 username/password pairs. Which of the following approaches would be most effective in evading the WAF while still testing a large number of credentials?

   • AUse a distributed network of proxies to rotate IP addresses for each request.
   • BUse a single IP address but randomize the user-agent header for each request.
   • CSlow down the attack to 1 request per minute from a single IP address.
   • DUse a single IP address but send requests through an HTTP proxy that modifies the X-Forwarded-For header.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary risk of using a predictable session token generation algorithm?

   • AThe session expires too quickly
   • BThe session cookie is visible in the URL
   • CAn attacker can guess or calculate valid session tokens
   • DThe session ID is stored in plaintext on the server
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A web application allows users to log in with a password and a one-time code sent to their email. A penetration tester discovers that the application does not invalidate the one-time code after a successful login and that the code is valid for 10 minutes. Which attack is most likely to succeed?

   • APerform a session fixation attack
   • BReplay the same one-time code to log in again within the validity window
   • CUse credential stuffing with the user's password
   • DBrute-force the one-time code by trying all 6-digit combinations
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is an example of a flawed state transition in an authentication workflow?

   • AStoring passwords as hashes
   • BAllowing a user to access authenticated pages without completing the login process
   • CUsing HTTPS for the login form
   • DRequiring a strong password policy
   Reveal Solution Discussion Select an answer first