Module 14 - Hacking Web Application ( EC Mode Part 02 ) Flashcards
Which of the following vulnerabilities occurs when an application adds files without the proper validation of inputs, thereby enabling an attacker to modify the input and embed path traversal characters?
A. File fingerprinting
B. Fileless malware
C. Local file inclusion
D. Security misconfiguration
Answer: C. Local file inclusion
Which of the following techniques does an attacker use to replace the value of the data source parameter with that of a rogue Microsoft SQL server?
A. Connection pool DoS
B. Hijacking web credentials
C. Port scanning
D. Hash stealing
Answer: D. Hash stealing
In which of the following attack techniques does an attacker lure victims via email or a link that is constructed such that the loopholes of remote execution code become accessible, allowing the attacker to obtain access privileges equal to those of authorized users?
A. Request forgery attack
B. ActiveX attack
C. Session fixation
D. Frame injection
Answer: B. ActiveX attack
Which of the following attacks is possible when an attacker executes .bat or .cmd files and changes the values by superimposing one or more operating-system commands through the request?
A. WS-address spoofing
B. Parsing attack
C. SOAPAction spoofing
D. XML injection attack
Answer: B. Parsing attack
An attacker tries to enumerate the username and password of an account named “rini Mathew” on wordpress.com. On the first attempt, the attacker tried to login as “rini.mathews,” which resulted in the login failure message “invalid email or username.” On the second attempt, the attacker tried to login as “rinimathews,” which resulted in a message stating that the password entered for the username was incorrect, thus confirming that the username “rinimathews” exists. What is the attack that is performed by the attacker?
A. Man-in-the-middle
B. Phishing
C. Brute-forcing
D. Username enumeration
Answer: D. Username enumeration
Which of the following web-service APIs is programmed to generate, recover, modify, and erase different logs such as profiles, credentials, and business leads?
A. JSON-RPC
B. XML-RPC
C. RESTful API
D. SOAP API
Answer: D. SOAP API
Which of the following API vulnerabilities allows attackers to gain unauthorized access to API objects or perform actions such as viewing, updating, or deleting?
A. Enumerated resources
B. RBAC privilege escalation
C. No ABAC validation
D. Business logic flaws
Answer: C. No ABAC validation
Which protocol provides transport-level security for API messages to ensure confidentiality through encryption and integrity through signature?
A. NTP
B. IMAP
C. SSL
D. FTP
Answer: C. SSL
Which metadata format does the SOAP API use to reveal a large amount of technical information such as paths, parameters, and message formats?
A. Swagger
B. I/O Docs
C. API-Blueprint
D. WSDL/XML-Schema
Answer: D. WSDL/XML-Schema
In which of the following attacks does an attacker saturate an API with a massive volume of traffic from multiple infected computers or botnets to delay the API services to legitimate users?
A. Credential stuffing attack
B. API DDoS attack
C. Invalid input attack
D. Fuzzing
Answer: B. API DDoS attack
Which of the following techniques is used by an attacker to connect a fake account on the provider with a victim’s account on the client side?
A. Attack on “redirect_uri”
B. CSRF on authorization response
C. Access token reusage
D. Attack on “Connect” request
Answer: B. CSRF on authorization response
Which of the following APIs is a user-defined HTTP callback or push API that is raised based on events triggered, such as receiving a comment on a post or pushing code to the registry?
A. REST API
B. Webhook
C. RESTful API
D. SOAP API
Answer: B. Webhook
Which of the following best practices should be followed to prevent web-shell installation?
A. Enable all PHP functions such as exec(), shell_exec(), show_source(), proc_open(), passthru(), and pcntl_exec()
B. Do not use escapeshellarg() or escapeshellcmd()
C. Establish a reverse proxy service for retrieving resources
D. Activate directory browsing in the web server
Answer: C. Establish a reverse proxy service for retrieving resources
In one of the following features of the RESTful API, the client end stores the state of the session, and the server is restricted to save data during request processing. Which is this feature?
A. Uniform interface
B. Cacheable
C. Code on demand
D. Stateless
Answer: D. Stateless
Which of the following techniques is NOT a best practice for securing webhooks?
A. Use threaded requests to send multiple requests simultaneously
B. Use rate limiting on webhook calls in the web server
C. Avoid validating the X-OP-Timestamp within the threshold of the current time
D. Ensure that event processing is idempotent
Answer: C. Avoid validating the X-OP-Timestamp within the threshold of the current time
Which of the following tools helps attackers intercept and analyze the target web APIs, websites, and web services?
A. Censys
B. ReqBin
C. GNU Radio
D. RTL-SDR
Answer: B. ReqBin
Identify the correct sequence of steps associated with the implicit grant type to exploit flawed scope validation:
1.After attaining the access token from the targeted client application, the attacker initiates a new request to its corresponding OAuth service provider with an altered scope /userinfo.
2.The attacker targets a vulnerable client application that utilizes an implicit grant-type process to attain access tokens from its clients through an open browser.
3.As the client has already granted permission for data access to the targeted client application, the attacker is now able to access additional information from the user until the OAuth server verifies and validates the scope parameter.
4.When the targeted client application obtains approval from its client and the corresponding access token is generated, the attacker attempts to pocket it.
A. 1 → 4 → 2 → 3
B. 3 → 4 → 2 → 1
C. 2 → 4 → 1 → 3
D. 1 → 2 → 3 → 4
Answer: C. 2 → 4 → 1 → 3
Which of the following tools allows attackers to gain remote control over the target web servers and manipulate the files and databases?
A. SearchDiggity
B. CyberX
C. CRITIFENCE
D. China chopper
Answer: D. China chopper
Identify the API security layer that creates a mapper layer to enable the conversion of all the database records into different user-visible models.?
A. Layer one
B. Layer two
C. Layer three
D. Layer four
E. Layer five
Answer: C. Layer three
Which of the following practices makes web APIs susceptible to different types of attacks?
A. Perform input validation on the server-side instead of the client-side to prevent bypassing attacks
B. Ensure that all the requests made from stateless communication APIs such as REST API are authorized separately, even if they originated from the same user
C. Share an excessive amount of secret data through status messages or resource replies
D. Conduct regular security assessments to secure all the API endpoints using automated tools
Answer: C. Share an excessive amount of secret data through status messages or resource replies
Which of the following protocols provides transport-level security for API messages to ensure confidentiality through encryption and integrity through signature?
A. IMAP
B. SSL
C. FTP
D. NTP
Answer: B. SSL
Which of the following parameters defines the level of access to an application to redirect a user agent to the authorization server?
A. redirect_uri
B. response_type
C. scope
D. State
Answer: C. scope
Which of the following API hacking techniques does not target the API or machine code and instead tricks users into divulging their credentials to perform further attacks?
A. Social engineering
B. Reverse engineering
C. Session replay attack
D. User spoofing
Answer: A. Social engineering
Which of the following API security risks can be prevented by performing input validation, implementing a parameterized interface for processing inbound API requests, and limiting the number of records returned?
A. Injection
B. Excessive data exposure
C. Mass assignment
D. Security misconfiguration
Answer: A. Injection
In which of the following attacks does an attacker repeatedly send some random input to a target API to generate error messages that reveal critical information?
A. Invalid input attack
B. Fuzzing
C. Login/credential stuffing attack
D. Malicious input attack
Answer: B. Fuzzing
In which of the following layers of API security, middleware can be used by the API to provide a query plan by calling the data layer?
A. Layer one
B. Layer two
C. Layer three
D. Layer four
Answer: B. Layer two
Tyler, a professional hacker, was hired to intercept and manipulate the web traffic of a rival organization. To achieve this goal, Tyler employed a tool that allowed him to capture the API traffic, including requests, responses, and cookies, using a built-in proxy for analyzing the target web services.
Identify the tool used by Tyler in the above scenario.?
A. DTC-340 RFXpert
B. Postman
C. Kismet
D. Elcomsoft Wireless Security Auditor
Answer: B. Postman
Given below are the different steps associated with authorization code grant type for the exploitation of flawed scope validation:
1.When the victim attempts to open the attacker’s malicious client application, the attacker initiates a request to the OAuth service provider for access to the client’s mail address using the OpenID email scope.
2.Attacker registers for the OAuth service that is used by the targeted resource owner for their malicious client application.
3.Now, the attacker attains a valid access token to access and pocket additional data by using the escalated scope to make usual API calls to the client.
4.When the user provides authorization for their request, the attacker attains an authorization code as a response.
5.Now, the attacker initiates the scope escalation process for the targeted client by controlling their malicious client application to add additional scope.
6.After approval from the OAuth server, the attacker attains a new access token containing the newly added additional scope.
Identify the correct sequence of steps associated with the authorization code grant type.?
A. 3 → 5 → 2 → 1 → 4 → 6
B. 6 → 3 → 1 → 5 → 4 → 2
C. 2 → 1 → 4 → 5 → 6 → 3
D. 2 → 1 → 3 → 4 → 5 → 6
Answer: C. 2 → 1 → 4 → 5 → 6 → 3
Which of the following practices helps security experts secure web APIs from various attacks?
A. Ensure that all the requests made from stateful communication APIs
B. Use client-generated tokens embedded in HTML as hidden fields for validating the incoming request
C. Use SOAP APIs with in-built security features instead of conventional design-based REST APIs
D. Do not implement a pagination technique
Answer: B. Use client-generated tokens embedded in HTML as hidden fields for validating the incoming request
