Web Application Authentication Attacks GWAPT Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A web application has a login endpoint that accepts a username and password. The application uses a JavaScript-based front end that hashes the password with SHA-256 before sending it to the server. The server then compares the received hash to a stored hash. A penetration tester wants to test for authentication logic flaws. Which of the following is the most likely vulnerability in this design?

   • AThe hash is vulnerable to replay attacks because it is sent over HTTP.
   • BThe hash is vulnerable to rainbow table attacks because SHA-256 is fast.
   • CThe server does not know the actual password, so it cannot enforce password complexity or check against breached password lists.
   • DThe server-side hash comparison is vulnerable to timing attacks.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which detection technique is most effective at identifying credential stuffing attacks that use a single username with many different passwords?

   • AChecking for the presence of a secure cookie flag
   • BVerifying that passwords meet complexity requirements
   • CReviewing server logs for HTTP 500 errors
   • DMonitoring for multiple failed login attempts from the same IP address
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A web application has a login form that checks the username and password in two separate steps. The application returns a generic error message for both invalid username and invalid password. However, the response time is slightly longer when the username is valid because the password hash is computed. A tester wants to enumerate valid usernames. Which technique is most effective?

   • AMeasure response times for various usernames and identify those with longer response times
   • BUse a dictionary attack on the password field for a single username
   • CCheck the HTTP status code for different usernames
   • DSend a large number of requests with random usernames and look for different error messages
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which technique is used to test for session fixation vulnerabilities in a web application?

   • AUsing SQL injection to extract session tokens from the database
   • BSending a large number of login requests to see if the account locks
   • CSetting a known session cookie before authentication and checking if it remains the same after login
   • DIntercepting traffic to capture session cookies in transit
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A penetration tester is using OWASP ZAP to test a web application's authentication. The tester wants to identify weak session tokens. Which of the following ZAP features is most appropriate for this task?

   • AThe Active Scanner, which tests for SQL injection and XSS.
   • BThe Spider, which crawls the application to find hidden endpoints.
   • CThe Session Token Analysis scanner, which analyzes the randomness of session tokens.
   • DThe Fuzzer, which can send random inputs to the session token parameter.
   Reveal Solution Discussion Select an answer first