GWAPT Authentication & Session Management 3

Question 1

What is a 'remember me' token vulnerability when the token is derived from the username and a static salt?

Accepted Answer

The token is predictable and can be forged for any user whose username is known

Answer

The token is too long to brute-force

Answer

The token expires after a single use

Answer

The token is stored server-side and cannot be manipulated

Question 2

Which HTTP header, when missing, allows a site to be framed in an iframe and facilitates clickjacking attacks that can steal authentication actions?

Accepted Answer

X-Frame-Options

Answer

X-Content-Type-Options

Answer

Content-Security-Policy frame-ancestors

Answer

Referrer-Policy

Question 3

An attacker captures a valid SAML assertion and replays it to log in as the victim. Which control specifically prevents this attack?

Accepted Answer

Enforcing assertion expiry and one-time use via NotOnOrAfter and InResponseTo validation

Answer

Signing the SAML assertion

Answer

Encrypting the SAML assertion

Answer

Using HTTP POST binding instead of redirect binding

Question 4

What is the risk of using client-side session management where the entire session state is stored in a cookie without server-side validation?

Accepted Answer

An attacker can tamper with the session state (e.g., role or user ID) if the cookie is not cryptographically signed and verified

Answer

The session will expire prematurely

Answer

The application cannot support concurrent sessions

Answer

The session cookie will be blocked by modern browsers

Question 5

A tester discovers the password reset link uses a short numeric token (e.g., 6 digits) sent via email. What attack is feasible?

Accepted Answer

Brute-force of the token space (1,000,000 possibilities) if no rate limiting exists

Answer

SQL injection through the token parameter

Answer

XSS via the email body

Answer

SSRF through the reset endpoint

Question 6

Which attack exploits the 'algorithm confusion' vulnerability in JWTs by switching from RS256 to HS256 and signing with the server's public key?

Accepted Answer

JWT algorithm confusion (key confusion) attack

Answer

JWT none algorithm attack

Answer

JWT header injection

Answer

JWT claim tampering

Question 7

During a web app pentest, you find login responses differ for valid vs. invalid usernames (e.g., 'Invalid password' vs. 'User not found'). What vulnerability does this expose?

Accepted Answer

Username enumeration

Answer

Insecure direct object reference

Answer

Blind SQL injection

Answer

Insecure deserialization