Session Security & Business Logic GWEB Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   An e-commerce application stores the user's role and account balance inside a signed cookie. A penetration tester discovers that the cookie is signed with a symmetric key that is hard-coded in the client-side JavaScript bundle. Which of the following is the most direct business logic impact of this flaw?

   • AAn attacker can cause a denial of service by sending a cookie with an invalid signature, crashing the application.
   • BAn attacker can read the cookie's contents, but cannot modify them because the signature is verified.
   • CAn attacker can replay a previously captured cookie to impersonate a user, but only if the session has not expired.
   • DAn attacker can forge a cookie with an elevated role and modify the account balance, leading to privilege escalation and unauthorized transactions.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   How does a session fixation attack typically work?

   • AThe attacker intercepts the session ID during transmission
   • BThe attacker sets a known session ID for the victim, and the victim authenticates with that ID
   • CThe attacker steals the session ID from the victim's browser using XSS
   • DThe attacker guesses the session ID by brute force
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which of the following is an acceptable method for generating a session identifier?

   • AUsing the user's username encoded in base64
   • BUsing the current timestamp in milliseconds
   • CUsing a sequential integer stored in a database
   • DUsing a cryptographically secure pseudo-random number generator (CSPRNG)
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A web application allows users to log in and then access their profile. A security tester notices that the session ID is not regenerated after login, and the session cookie is set with SameSite=None. Which of the following is the most likely attack that the tester can demonstrate?

   • ASession fixation, where an attacker sets the victim's session ID before login and then uses the same ID after authentication.
   • BSession hijacking via a man-in-the-middle attack because the cookie is not Secure.
   • CCross-site request forgery, where the attacker uses the SameSite=None cookie to send a forged request.
   • DSession prediction, where the attacker guesses the session ID because it is generated with low entropy.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A user logs out of a web application, but a security review shows that the session remains active on the server for another 30 minutes. The session cookie is also not cleared on the client. Which combination of changes should be implemented?

   • AChange the session ID to a random value and keep the old session for 30 minutes.
   • BInvalidate the session on the server and clear the session cookie on the client during logout.
   • CSet the session cookie to expire in 1 minute and rely on the browser to delete it.
   • DOnly clear the session cookie on the client and keep the server session for audit purposes.
   Reveal Solution Discussion Select an answer first