GWAPT Authentication & Session Management 2

Question 1

Which attack targets OAuth 2.0 by intercepting the authorization code in the redirect URI to obtain access tokens?

Accepted Answer

Authorization code interception

Answer

Open redirect exploitation

Answer

Token replay

Answer

PKCE bypass

Question 2

What is the purpose of PKCE (Proof Key for Code Exchange) in OAuth 2.0?

Accepted Answer

To prevent authorization code interception attacks by binding the code to a verifier secret

Answer

To encrypt the access token payload

Answer

To rotate refresh tokens automatically

Answer

To validate the redirect URI against a whitelist

Question 3

A penetration tester identifies that the application uses HTTP Basic Authentication over HTTPS. What is the most critical risk to document?

Accepted Answer

Credentials are Base64-encoded, not encrypted, so they are exposed if TLS is stripped or misconfigured

Answer

Basic Auth cookies expire after each request

Answer

The server does not support multi-factor authentication

Answer

Basic Auth tokens are stored in the URL and cached by browsers

Question 4

Which technique allows an attacker to bypass multi-factor authentication by forwarding the victim's authenticated session in real time?

Accepted Answer

Real-time phishing proxy (reverse proxy phishing)

Answer

Credential stuffing

Answer

Pass-the-hash

Answer

Token prediction

Question 5

An application stores session tokens in localStorage. What risk does this introduce compared to HttpOnly cookies?

Accepted Answer

localStorage is accessible via JavaScript, making tokens vulnerable to XSS theft

Answer

localStorage tokens are automatically cleared on browser close

Answer

localStorage tokens cannot be transmitted in HTTP headers

Answer

localStorage enforces same-origin policy more strictly than cookies

Question 6

During testing you find that changing the 'role' claim in a JWT from 'user' to 'admin' grants elevated privileges. What root cause explains this finding?

Accepted Answer

The server is not verifying the token signature

Answer

The server is not validating the token expiry

Answer

The token is transmitted over HTTP

Answer

The algorithm is set to RS256 instead of HS256

Question 7

Which Burp Suite feature is most useful for automatically detecting weak or predictable session tokens?

Accepted Answer

Sequencer

Answer

Burp Collaborator

Answer

Intruder

Answer

Comparer