CVA CVA Web Application & API Security 1 — Questions and Answers
Question 1: Which OWASP Top 10 vulnerability occurs when user-supplied input is included in a web page without proper sanitization, allowing scripts to execute in a victim's browser?
- SQL Injection
- Cross-Site Scripting (XSS) (Correct answer)
- Insecure Direct Object Reference
- Security Misconfiguration
Correct answer: Cross-Site Scripting (XSS)
Cross-Site Scripting (XSS) occurs when unsanitized user input is reflected or stored in a web page, causing malicious scripts to execute in other users' browsers.
Question 2: During a web application assessment, you discover that changing the 'user_id' parameter in a GET request reveals another user's account data. Which vulnerability is this?
- SQL Injection
- CSRF
- Insecure Direct Object Reference (IDOR) (Correct answer)
- Broken Authentication
Correct answer: Insecure Direct Object Reference (IDOR)
IDOR occurs when an application exposes internal object references (such as user IDs) that can be manipulated to access unauthorized data.
Question 3: Which HTTP method should be tested during a web application vulnerability assessment to check for unintended server-side functionality exposure?
- GET
- POST
- PUT and DELETE (Correct answer)
- HEAD
Correct answer: PUT and DELETE
PUT and DELETE methods can expose unintended server-side functionality such as file upload or deletion, and should always be tested during web assessments.
Question 4: What is the primary purpose of testing for Server-Side Request Forgery (SSRF) in a web application?
- To steal session cookies
- To make the server perform requests to internal or external resources on behalf of the attacker (Correct answer)
- To bypass SSL certificate validation
- To enumerate valid usernames
Correct answer: To make the server perform requests to internal or external resources on behalf of the attacker
SSRF allows attackers to coerce a server into making HTTP requests to internal services or external URLs, potentially exposing cloud metadata endpoints or internal networks.
Question 5: When assessing REST API security, which attack involves sending crafted JSON payloads to exploit parsing differences between services?
- Mass Assignment
- JSON Interoperability Vulnerability (Correct answer)
- Parameter Pollution
- Rate Limit Bypass
Correct answer: JSON Interoperability Vulnerability
JSON interoperability vulnerabilities exploit inconsistencies in how different JSON parsers handle duplicate keys or unexpected types, potentially bypassing security controls.
Question 6: Which tool is specifically designed to perform automated scanning of web application vulnerabilities including SQLi, XSS, and LFI?
- Nmap
- Nikto (Correct answer)
- Wireshark
- Metasploit
Correct answer: Nikto
Nikto is an open-source web server scanner that checks for dangerous files, outdated software, and common vulnerabilities such as SQLi, XSS, and LFI.
CVA CVA Web Application & API Security 1
Which OWASP Top 10 vulnerability occurs when user-supplied input is included in a web page without proper sanitization, allowing scripts to execute in a victim's browser?