eJPT Web Application Security & Testing 5

Question 1

When performing a web application penetration test, you find the application uses JWT tokens for authentication. What is a common vulnerability to test for?

Accepted Answer

Using the 'none' algorithm to bypass signature verification

Answer

Some JWT libraries accept 'alg: none', removing the signature requirement entirely, allowing attackers to forge tokens by setting the algorithm to none and stripping the signature.

Question 2

Which technique can be used to test for blind SQL injection when the application produces no visible error messages?

Accepted Answer

Sending time-delay payloads like SLEEP() or WAITFOR DELAY

Answer

Time-based blind SQL injection uses conditional delay functions (e.g., SLEEP(5)) to infer true/false conditions from how long the server takes to respond.

Question 3

What is 'subdomain takeover' in the context of web application security testing?

Accepted Answer

Claiming an abandoned subdomain's external resource to serve malicious content under the target's domain

Answer

Subdomain takeover occurs when a DNS CNAME points to an external service that has been deprovisioned; an attacker can register that service and serve content under the victim's subdomain.

Question 4

In a web application test, which HTTP status code suggests that a resource exists but is intentionally hidden or restricted, as opposed to truly not existing?

Accepted Answer

403 Forbidden

Answer

A 403 Forbidden response confirms the resource exists but access is denied, making it a valuable signal during directory enumeration that something interesting may be behind the restriction.

Question 5

What is the primary goal of testing for 'business logic flaws' in web applications?

Accepted Answer

Discovering ways to abuse legitimate application functionality to achieve unintended outcomes

Answer

Business logic flaws involve exploiting the intended workflow of an application — such as skipping payment steps or applying discounts multiple times — rather than technical injection vulnerabilities.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Web Application Security & Testing 5