Web Application Overview GWAPT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A web application allows users to upload profile pictures. The upload handler checks the file extension against a list of allowed types (e.g., .png, .jpg) and stores the file in a directory that is served as static content. A tester discovers that by uploading a file named avatar.png containing PHP code, they can execute code on the server. Which additional control would best prevent this attack?

   • AStore the file outside the web root and serve it via a download script
   • BValidate the file content by checking the magic bytes and re-encoding the image
   • CSet the file permissions to read-only after upload
   • DRename the uploaded file to a random name with a .txt extension
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A web application allows users to change their email address. The change is made by sending a POST request to /account/email with the new email address. The application does not require the user's password to confirm the change. A tester finds that the request is vulnerable to CSRF because there is no anti-CSRF token. Which of the following is the most effective mitigation to implement?

   • ACheck the Origin header on the server
   • BUse a POST request instead of a GET request
   • CInclude a synchronizer token in the form and validate it on the server
   • DRequire the user to re-enter their password for the email change
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In a web application, which component is responsible for verifying the identity of a user who presents credentials such as a username and password?

   • AAuthorization policy
   • BAuthentication mechanism
   • CHTTP header
   • DSession cookie
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A web application has a password reset feature that sends a reset link to the user's email. The link contains a token that is valid for 24 hours. A tester discovers that the token is generated using the user's email address and the current timestamp. Which attack is most feasible?

   • ASession fixation
   • BCSRF on the reset form
   • COpen redirect via the reset link
   • DPredicting another user's reset token
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which web application feature is primarily responsible for maintaining a user's authenticated state across multiple HTTP requests?

   • AInput validation
   • BOutput encoding
   • CSession management
   • DDatabase indexing
   Reveal Solution Discussion Select an answer first