Web Application Overview GWAPT Practice Questions (Page 8)

Questions 36–39

1. 36application · medium

   A web application is deployed with a reverse proxy in front of the application server. The application uses HTTPS, and the reverse proxy terminates TLS. The application server receives requests over HTTP from the proxy. A developer notices that the application sometimes generates URLs with 'http://' instead of 'https://' in redirects. What is the most likely cause?

   • AThe application server is using HTTP/2
   • BThe application is not aware that the original request was HTTPS
   • CThe reverse proxy is not configured to set the Host header
   • DThe session cookie is missing the Secure flag
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A penetration tester is assessing a web application that uses a JSON-based API. The tester sends a request with the header Content-Type: application/json and a body that includes a nested object. The application parses the JSON and uses the value of a field to construct an SQL query. The tester wants to test for SQL injection. Which of the following is the most appropriate technique?

   • AModify the Content-Type header to application/x-www-form-urlencoded
   • BChange the HTTP method from POST to GET to see if the API behaves differently
   • CInsert a single quote in the field value and observe the application's response for an SQL error
   • DAdd a second field with the same name to the JSON body
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which HTTP status code class indicates that the server has received the request, understood it, and is processing it, but a final response is not yet available?

   • A3xx (Redirection)
   • B4xx (Client Error)
   • C1xx (Informational)
   • D2xx (Successful)
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A penetration tester is evaluating an application that uses HTTP Basic authentication over HTTPS. The tester notices that the application also supports a legacy HTTP endpoint on port 80 that redirects to HTTPS. The tester wants to determine if credentials can be intercepted. Which of the following is the most significant risk?

   • AThe Basic authentication header is sent in cleartext on the HTTPS connection
   • BThe HTTPS endpoint is vulnerable to a downgrade attack if the server supports weak cipher suites
   • CThe HTTP endpoint may allow a man-in-the-middle attacker to inject a redirect to a malicious server that captures the Basic authentication credentials
   • DThe redirect from HTTP to HTTPS is vulnerable to session fixation
   Reveal Solution Discussion Select an answer first