Web and application pentesting: understanding vulnerabilities Quiz

Quiz: access control and business logic

Pass mark: 70%. You can retry as many times as you need.

1 Customer Bob requests /orders/1043, which belongs to Alice, with his own session, and receives Alice’s order. What is this flaw? Single answer Cross-site request forgery An IDOR (broken object-level access control) SQL injection Clickjacking

2 Which measures properly prevent IDOR and privilege escalation? (several answers) Multiple answers possible Checking authorisation on the server for every request, with deny by default Hiding the admin menu from non-admin users Scoping database lookups to the current user Taking the owner from the session instead of from a request parameter

3 An update-profile endpoint accepts a JSON body and copies every field into the user object. A tester adds an extra field called role to the request and the account becomes admin. What is this weakness called? Single answer Session fixation Server-side request forgery Clickjacking Mass assignment leading to vertical privilege escalation

4 A checkout confirmation page can be reached directly without going through payment. What does this illustrate? Single answer A business logic flaw: the order of steps is not enforced by the server A flaw in the HTTPS certificate A weak password policy A reflected XSS

5 An application downloads an image from a URL typed by the user. Which controls reduce the SSRF risk? (several answers) Multiple answers possible Only accept destinations from an allowlist, over https Block the single word localhost and consider the problem solved Do not follow redirects automatically Restrict outbound network access from the server, including to internal services