Web Application Authentication Attacks GWAPT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A penetration tester is assessing a web application that uses a JSON-based login API. The tester wants to test for credential stuffing using a large list of breached usernames and passwords. The application returns HTTP 200 with a generic error message for invalid credentials, but returns HTTP 429 after 10 failed attempts from the same IP. Which approach would be most effective for the tester to continue testing without being blocked?

   • ARotate the X-Forwarded-For header with different IP addresses while keeping the source IP constant.
   • BUse a single IP but randomize the order of usernames and passwords to avoid detection by the rate limiter.
   • CDistribute the login attempts across multiple source IP addresses, either through a proxy pool or a botnet, while keeping the request rate moderate per IP.
   • DUse a single IP address and slow the request rate to 1 request per 10 seconds to stay below the rate limit.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester is analyzing a web application that uses cookies for session management. The tester notices that the session cookie does not have the Secure flag and the application is served over HTTPS. Which attack is most directly enabled?

   • ACredential stuffing
   • BSession hijacking via network sniffing
   • CSession fixation
   • DPassword reset poisoning
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What makes a password reset token vulnerable to prediction?

   • AThe token expires after 24 hours
   • BThe token is stored in a database
   • CThe token is sent via email
   • DThe token is generated using a timestamp and user ID
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a common session-based attack vector that targets the session identifier after a user has authenticated?

   • ABrute force
   • BCredential stuffing
   • CSession hijacking
   • DSQL injection
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A penetration tester is assessing a web application that allows users to log in with email and password. The tester notices that the application does not lock accounts after multiple failed attempts and does not implement any rate limiting on the login endpoint. The tester wants to demonstrate the risk of credential stuffing without causing a denial-of-service condition. Which approach is most appropriate?

   • AUse a tool to automatically generate random passwords and test them against every account
   • BRun a full dictionary attack against all user accounts with thousands of passwords per account
   • CAttempt to reset passwords for all users to test the password reset flow
   • DUse a small, curated list of known breached credentials for a few test accounts and monitor response times
   Reveal Solution Discussion Select an answer first