GWAPT Authentication & Session Management 3

Question 1

What is a 'remember me' token vulnerability when the token is derived from the username and a static salt?

Accepted Answer

The token is predictable and can be forged for any user whose username is known

Answer

Using a static salt means anyone who knows the derivation algorithm and a username can compute a valid persistent token for that account.

Question 2

Which HTTP header, when missing, allows a site to be framed in an iframe and facilitates clickjacking attacks that can steal authentication actions?

Accepted Answer

X-Frame-Options

Answer

X-Frame-Options (and the equivalent CSP frame-ancestors directive) prevents the browser from rendering the page inside a frame, blocking clickjacking.

Question 3

An attacker captures a valid SAML assertion and replays it to log in as the victim. Which control specifically prevents this attack?

Accepted Answer

Enforcing assertion expiry and one-time use via NotOnOrAfter and InResponseTo validation

Answer

Validating NotOnOrAfter timestamps and the InResponseTo field against a nonce ensures each assertion can only be used once within a time window.

Question 4

What is the risk of using client-side session management where the entire session state is stored in a cookie without server-side validation?

Accepted Answer

An attacker can tamper with the session state (e.g., role or user ID) if the cookie is not cryptographically signed and verified

Answer

Without cryptographic integrity checks on the cookie, an attacker can modify its contents (e.g., elevate privileges) and the server will trust the altered data.

Question 5

A tester discovers the password reset link uses a short numeric token (e.g., 6 digits) sent via email. What attack is feasible?

Accepted Answer

Brute-force of the token space (1,000,000 possibilities) if no rate limiting exists

Answer

A 6-digit numeric token has only one million possible values; without rate limiting or lockout, an attacker can enumerate all values to hijack any reset.

(GWAPT) Giac Web Application Penetration Tester Practice Test

(GWAPT) Giac Web Application Penetration Tester Practice Test

GWAPT Authentication & Session Management 3