GWAPT Authentication & Session Management 2

Question 1

Which attack targets OAuth 2.0 by intercepting the authorization code in the redirect URI to obtain access tokens?

Accepted Answer

Authorization code interception

Answer

Authorization code interception captures the short-lived code from the redirect URI, allowing the attacker to exchange it for an access token.

Question 2

What is the purpose of PKCE (Proof Key for Code Exchange) in OAuth 2.0?

Accepted Answer

To prevent authorization code interception attacks by binding the code to a verifier secret

Answer

PKCE uses a code verifier and code challenge so that even if the authorization code is intercepted, it cannot be exchanged without the original secret.

Question 3

A penetration tester identifies that the application uses HTTP Basic Authentication over HTTPS. What is the most critical risk to document?

Accepted Answer

Credentials are Base64-encoded, not encrypted, so they are exposed if TLS is stripped or misconfigured

Answer

HTTP Basic Auth encodes credentials in Base64 (not encryption), so any TLS downgrade or misconfiguration exposes them in plaintext.

Question 4

Which technique allows an attacker to bypass multi-factor authentication by forwarding the victim's authenticated session in real time?

Accepted Answer

Real-time phishing proxy (reverse proxy phishing)

Answer

A reverse proxy phishing tool (e.g., Evilginx2) sits between victim and target, relaying requests and capturing session cookies after MFA completion.

Question 5

An application stores session tokens in localStorage. What risk does this introduce compared to HttpOnly cookies?

Accepted Answer

localStorage is accessible via JavaScript, making tokens vulnerable to XSS theft

Answer

Unlike HttpOnly cookies, localStorage is accessible to JavaScript on the page, so any XSS flaw allows an attacker to steal the token.

(GWAPT) Giac Web Application Penetration Tester Practice Test

(GWAPT) Giac Web Application Penetration Tester Practice Test

GWAPT Authentication & Session Management 2