PenTest+ Web Application Security Testing 3

Question 1

Which HTTP security header specifically prevents a web page from being embedded in an iframe to mitigate clickjacking attacks?

Accepted Answer

X-Frame-Options

Answer

The `X-Frame-Options` header (or the `frame-ancestors` CSP directive) controls whether a browser should allow a page to be rendered inside a frame, directly preventing clickjacking.

Question 2

During a pentest, you find that the `Set-Cookie` header is missing the `HttpOnly` flag. What attack does this enable?

Accepted Answer

Cookie theft via JavaScript (XSS)

Answer

Without the `HttpOnly` flag, cookies are accessible via JavaScript, meaning a successful XSS attack can steal session cookies and allow account takeover.

Question 3

A web application uses OAuth 2.0 and does not validate the `state` parameter during the authorization callback. What attack is possible?

Accepted Answer

Cross-Site Request Forgery on OAuth Flow

Answer

The OAuth `state` parameter functions as a CSRF token; without validating it, an attacker can forge a callback request and link their malicious account to a victim's session.

Question 4

A JWT token uses `alg: none` and is accepted by the server without signature verification. What is this vulnerability called?

Accepted Answer

Algorithm Confusion (None Algorithm)

Answer

The 'none' algorithm attack exploits servers that accept JWTs with no signature when `alg` is set to `none`, allowing attackers to forge arbitrary token claims without a valid signature.

Question 5

An application server sends the header `Access-Control-Allow-Origin: *` with `Access-Control-Allow-Credentials: true`. Why is this a security risk?

Accepted Answer

It allows any origin to make credentialed cross-origin requests, exposing authenticated data

Answer

A wildcard origin combined with `Allow-Credentials: true` is an invalid but dangerously misconfigured CORS policy; browsers block this combination, but some frameworks mishandle it by reflecting the request origin, granting any attacker site access to credentialed responses.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ Web Application Security Testing 3