Web Application Overview GWAPT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A web application's login form submits credentials via a POST request. The server responds with a 302 redirect to a dashboard page. A penetration tester notices that the redirect target is taken from a 'next' parameter in the POST body. What is the primary security risk of this implementation?

   • AOpen redirect that can be used for phishing
   • BInformation disclosure because the POST body is logged
   • CCSRF because the POST request can be forged
   • DSession fixation because the session ID is in the URL
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A web application uses a JavaScript frontend that sends user credentials to a backend API. The API then queries a database to verify the user and returns a session token. During a penetration test, you notice that the API returns a 200 OK response with a JSON body containing the user's password hash when the login endpoint is accessed with a malformed request. Which component of the architecture is most directly responsible for this behavior?

   • AThe database stored procedure
   • BThe network middleware load balancer
   • CThe backend API endpoint
   • DThe frontend JavaScript code
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A web application allows users to upload profile pictures. The server checks the file extension and MIME type from the upload request. A penetration tester successfully uploads a file with a .jpg extension that contains PHP code and then executes it by accessing the file directly. Which missing control allowed this attack?

   • AHTTPS encryption for the upload request
   • BCSRF token on the upload form
   • CRate limiting on the upload endpoint
   • DContent validation of the file's actual content
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A web application is composed of a static frontend served by a CDN, a backend API running on a server, and a database. The API is protected by an API key that is embedded in the frontend JavaScript code. A penetration tester extracts the API key and uses it to access the API directly, bypassing the frontend. Which of the following is the most effective mitigation?

   • AImplement server-side authorization and rate limiting on the API
   • BUse a different API key for each user
   • CRestrict the API to only accept requests from the CDN domain
   • DMove the API key to an HTTP-only cookie
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A web application allows users to upload files that are then served from a CDN. The application uses a signed URL to grant temporary access to the uploaded file. A tester discovers that the signed URL is generated using a timestamp and a secret key, but the secret key is embedded in the client-side JavaScript. Which of the following is the most significant security implication?

   • AAn attacker can extract the secret key from the JavaScript and generate valid signed URLs for any file
   • BThe CDN will not cache the file because the URL is signed
   • CThe signed URL is vulnerable to replay attacks because the timestamp is not checked
   • DThe signed URL is vulnerable to brute force because the timestamp is predictable
   Reveal Solution Discussion Select an answer first