I85PREP
⌘ K
OSWE study materials
OSWE study resources

OSWE practice questions

One question at a time. Build your OSWE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Source Code Analysis and Web Application Reconnaissance

Which PHP operator evaluates the two distinct strings "0e123" and "0e999" as equal during comparison?

  1. == Correct answer.
  2. hash_equals
  3. ===
  4. strcmp

Explanation

Loose equality coerces numeric-looking strings to numbers before comparing, and both of these become zero, so they compare equal. Strict identity compares type and value and would never match two different strings, and the comparison functions do not perform numeric coercion.

Question 2Source Code Analysis and Web Application Reconnaissance

A PHP script calls `extract($_GET);` before using a variable `$isAdmin` that was set earlier in the file. What is the security consequence?

  1. It converts every request parameter into a global constant at parse time.
  2. It blocks the request when duplicate keys are present.
  3. It escapes all request values, preventing injection.
  4. Request parameters can overwrite existing variables such as $isAdmin. Correct answer.

Explanation

extract() imports array keys into the local symbol table, so any request parameter whose name matches an existing variable replaces that variable's value. The function performs no filtering, escaping, or duplicate-key handling.

Question 3Source Code Analysis and Web Application Reconnaissance

What does the `/e` modifier do in PHP's `preg_replace()` when applied to a pattern with user-influenced replacement text?

  1. It escapes the replacement so it is inserted literally.
  2. It limits replacement to the first match only.
  3. It enables extended multi-line pattern matching.
  4. It evaluates the replacement string as PHP code. Correct answer.

Explanation

The /e modifier treats the replacement argument as PHP source and evaluates it after substitution, turning a string operation into an eval sink. It was removed in PHP 7, but legacy codebases still contain it.

Question 4Source Code Analysis and Web Application Reconnaissance

A Flask application calls `pickle.loads(request.cookies.get('session'))`. Why is this dangerous?

  1. Pickle cannot handle bytes, so the call always raises.
  2. Unpickling attacker data can invoke arbitrary callables. Correct answer.
  3. Pickle only supports dictionaries, so valid sessions break.
  4. Pickle output is encrypted, so the server cannot read it.

Explanation

The pickle format can reference Python callables and their arguments, so a crafted stream causes the interpreter to execute attacker-chosen code during loading. It is also not encrypted, and cookies can easily be converted to the byte strings the loader expects.

Question 5Source Code Analysis and Web Application Reconnaissance

Which Java call is a command-execution sink when its argument is built from request data?

  1. System.getenv(cmd)
  2. String.valueOf(cmd)
  3. Runtime.getRuntime().exec(cmd) Correct answer.
  4. File.createTempFile(cmd, null, dir)

Explanation

Runtime.exec starts an operating system process using the supplied string, so any attacker influence over that string can be turned into command execution. The other calls only convert, create, or read data without spawning a process.

Question 6Source Code Analysis and Web Application Reconnaissance

A PHP page runs `include($_GET['page'] . '.php');`. Which attack does this directly enable when the parameter is not validated?

  1. Session fixation through a crafted PHPSESSID cookie
  2. HTTP request smuggling
  3. Cross-site request forgery
  4. Local file inclusion with path traversal Correct answer.

Explanation

The include path is built from raw request data, so dot-segments can climb out of the intended directory and load other server-side files, and the suffix can often be absorbed with a null byte or a wrapper on older versions. The result is disclosure or inclusion of unintended local files.

Question 7Source Code Analysis and Web Application Reconnaissance

In Node.js, which statement about `child_process.exec` versus `child_process.execFile` is accurate?

  1. exec interprets shell metacharacters in the string Correct answer.
  2. execFile always spawns a shell, while exec does not use one.
  3. execFile passes its arguments to a shell for expansion before running.
  4. Both refuse to run any command that contains a pipe character.

Explanation

exec hands the whole command string to a shell, so metacharacters such as pipes, semicolons, and backticks are interpreted. execFile launches the binary directly with an argument array and performs no shell expansion.

Question 8Source Code Analysis and Web Application Reconnaissance

Which coding pattern is the root source of a classic SQL injection in a login handler?

  1. Escaping output with htmlspecialchars before rendering
  2. Hashing the submitted password with bcrypt
  3. Using parameterised queries with bound placeholders
  4. Concatenating raw request values into the query Correct answer.

Explanation

Injection exists when untrusted input changes the structure of the SQL statement, which happens when it is concatenated into the query text. Binding placeholders keeps input as data, while output encoding and password hashing address different problems entirely.

Question 9Source Code Analysis and Web Application Reconnaissance

A PHP class defines `__destruct()` which calls `system($this->cmd)`. The app runs `unserialize(base64_decode($_COOKIE['state']))`. What is the shortest path to code execution?

  1. Overwrite the session file through the public upload form
  2. Send a JSON body that names the class and its constructor
  3. Append ?cmd= to a URL handled by the affected script
  4. Send a serialized instance with cmd set to the payload Correct answer.

Explanation

Because the cookie is deserialized directly, an attacker can craft a serialized object of the vulnerable class whose cmd property holds the command; the magic method fires when the object is destroyed at request shutdown. No other channel is needed.

Question 10Source Code Analysis and Web Application Reconnaissance

A Flask view does `return render_template_string(request.args['t'])`. Which vulnerability does this introduce?

  1. XML external entity injection
  2. Server-side template injection Correct answer.
  3. Cross-site scripting
  4. Open redirect through the template name

Explanation

Passing request data as the template source lets the attacker write Jinja expressions that the engine evaluates on the server, which can escalate to file reads or command execution. The template name is not user controlled here, and no XML parser is involved.

Question 11Source Code Analysis and Web Application Reconnaissance

Which Java API is the primary sink for untrusted-data deserialization vulnerabilities?

  1. java.io.ObjectInputStream.readObject Correct answer.
  2. javax.xml.parsers.DocumentBuilder
  3. java.sql.PreparedStatement
  4. java.nio.file.Files.readAllBytes

Explanation

readObject reconstructs arbitrary classes from the byte stream and runs their readObject and readResolve hooks, which gadget chains abuse to reach dangerous methods. The other APIs handle SQL binding, XML parsing, and raw file reads.

Question 12Source Code Analysis and Web Application Reconnaissance

In PHP versions before 8.0, what happens when `assert()` receives a string built from user input?

  1. The string is hashed and compared to a stored digest.
  2. The string is evaluated as PHP code. Correct answer.
  3. The call raises a fatal parse error at runtime.
  4. The string is escaped and compared to the literal 'true'.

Explanation

When assertions are enabled, the string form of assert() is passed to the evaluator, so injected PHP syntax runs as code. This turns any assert() that receives request data into an eval-equivalent sink.

Question 13Source Code Analysis and Web Application Reconnaissance

Why should Ruby code replace `YAML.load` with `YAML.safe_load` when parsing user-supplied YAML?

  1. YAML.load can instantiate arbitrary Ruby objects Correct answer.
  2. YAML.safe_load is faster for nested documents
  3. YAML.load cannot parse anchors and aliases
  4. YAML.safe_load preserves comments and key ordering in the file

Explanation

The default loader honours tags that construct arbitrary Ruby objects, and some of those objects run code on initialisation, giving an object-injection primitive. safe_load restricts construction to a small set of primitive types.

Question 14Source Code Analysis and Web Application Reconnaissance

An Express route calls `res.sendFile(path.join(UPLOAD_DIR, req.query.name))`. Why is this still vulnerable to path traversal?

  1. path.join strips all dot segments from the input
  2. path.join resolves ../ segments before the file is opened Correct answer.
  3. res.sendFile refuses to serve files outside the cwd
  4. req.query values are already URL-decoded by Express

Explanation

path.join normalises the path, so ../ sequences are resolved and the resulting absolute path can point outside the upload directory; the framework then serves whatever path it was given. Validation or an explicit root option is required.

Question 15Source Code Analysis and Web Application Reconnaissance

A login check reads `if (strcmp($_POST['pass'], $secret) == 0)`. What defeats it when the parameter is sent as an array?

  1. strcmp returns the secret to the caller
  2. strcmp compares array length only
  3. strcmp throws a fatal error the attacker catches
  4. strcmp returns null, and null == 0 is true Correct answer.

Explanation

strcmp expects strings; given an array it emits a warning and returns null, which loose comparison treats as equal to zero, so the check passes. The fix is to require string types and compare with strict identity.

Question 16Source Code Analysis and Web Application Reconnaissance

Which mitigation is appropriate for a user-selectable sort column in an ORDER BY clause?

  1. Whitelist the value against a fixed list of columns Correct answer.
  2. Escape the column name with addslashes before use
  3. Bind the column name as a string parameter
  4. Wrap the column name in single quotes inside the query

Explanation

Placeholders bind values, not identifiers, so a column name can never be supplied as a bound parameter; the only safe approach is to map the requested key onto a hard-coded list of permitted column names. Escaping and quoting do not turn an identifier into data.

Question 17Source Code Analysis and Web Application Reconnaissance

A route handler calls `require('./modules/' + req.query.mod)`. What is the primary risk?

  1. Leaking environment variables through the module cache
  2. Bypassing the package lockfile integrity checks
  3. Denial of service through very long module names
  4. Loading attacker-chosen modules, possibly executing code Correct answer.

Explanation

require resolves the assembled path at runtime, so traversal sequences can reach other files on disk, and any loaded JavaScript module executes its top-level code. That converts a path-traversal flaw into code execution.

Question 18Source Code Analysis and Web Application Reconnaissance

A developer uses `Runtime.getRuntime().exec("ping " + host)` hoping to block shell metacharacters. How does this call actually parse the argument?

  1. It URL-decodes the string before execution
  2. It passes the string to /bin/sh -c on every platform
  3. It splits the string on whitespace and runs ping directly Correct answer.
  4. It rejects any string containing a semicolon

Explanation

The single-string overload tokenises on whitespace and executes the resulting program directly without a shell, so metacharacters are passed as literal text. That blocks classic shell injection but still permits argument injection, because the attacker controls extra arguments.

Question 19Source Code Analysis and Web Application Reconnaissance

Which .NET API is the classic sink for untrusted deserialization leading to remote code execution?

  1. BinaryFormatter.Deserialize Correct answer.
  2. JsonSerializer.DeserializeAsync
  3. SHA256.ComputeHash
  4. XDocument.Parse

Explanation

BinaryFormatter encodes type information in the stream and reconstructs the named types, running their deserialization callbacks, which gadget chains abuse. Microsoft has deprecated it for exactly this reason; the other calls parse text or compute digests.

Question 20Source Code Analysis and Web Application Reconnaissance

Which substitution removes code execution risk when parsing a numeric expression supplied by the user in Python?

  1. Use ast.literal_eval instead of eval Correct answer.
  2. Wrap the call in try/except
  3. Pass the input through urllib.parse.quote
  4. Encode the input with base64 first

Explanation

ast.literal_eval parses only literal structures and raises on calls, attribute access, and names, so no code runs. eval executes arbitrary expressions, and input mangling such as encoding or exception handling does not change that.

Question 21Source Code Analysis and Web Application Reconnaissance

Prior to PHP 8.0, a PHP app calls `file_exists()` on a path beginning with `phar://`. Why can this lead to object injection without any call to unserialize()?

  1. file_exists executes the stream wrapper as PHP code
  2. The phar wrapper writes attacker data to disk first
  3. file_exists follows symlinks into the include path
  4. Phar metadata is unserialized when the archive is opened Correct answer.

Explanation

Opening a phar archive through the stream wrapper makes PHP unserialize the archive's stored metadata, invoking magic methods on the reconstructed objects. Any file operation on a phar:// path is therefore a deserialization trigger.

Question 22Source Code Analysis and Web Application Reconnaissance

In a Java deserialization gadget chain, what property must the entry-point class have for the chain to trigger during readObject()?

  1. It must define a readObject method with side effects Correct answer.
  2. It must be annotated with @Serializable
  3. It must extend java.lang.Thread
  4. It must implement the Cloneable interface

Explanation

The entry point must run attacker-influenced logic while the object graph is being rebuilt, which is why a custom readObject or readResolve method that reaches a dangerous sink is required. Ordinary fields alone do nothing during deserialization.

Question 23Source Code Analysis and Web Application Reconnaissance

Which YAML construct allows a document parsed by an unsafe PyYAML loader to call an arbitrary Python callable?

  1. !!binary with a base64-encoded blob
  2. !!python/object/apply Correct answer.
  3. !!merge combined with an anchor alias
  4. !!set containing duplicate mapping keys

Explanation

The python/object/apply tag names a callable and supplies its arguments, so the loader constructs and invokes it while building the document. Restricting the loader to SafeLoader rejects all python/* tags.

Question 24Source Code Analysis and Web Application Reconnaissance

Which chain turns prototype pollution in a Node.js application into remote code execution?

  1. Setting Object.prototype.hash to a template literal
  2. Polluting child_process spawn options such as shell or env Correct answer.
  3. Polluting JSON.parse to return attacker objects
  4. Overwriting Array.prototype.sort with a string payload

Explanation

Many libraries merge attacker-supplied keys into options objects without guarding __proto__, so a polluted property reaches child_process.spawn, where setting shell to a shell path or injecting env/LD_PRELOAD values produces command execution.

Question 25Source Code Analysis and Web Application Reconnaissance

A Python code sandbox runs user input through eval() after clearing __builtins__. Which technique restores access to os.system?

  1. Call help() and read the licence text
  2. Walk __subclasses__() from an object to find os Correct answer.
  3. Write os into the builtins dictionary directly
  4. Use sys.exit() to reach the interpreter frame

Explanation

Clearing __builtins__ removes names, not object graph reachability, so starting from a literal such as ().__class__.__bases__[0].__subclasses__() recovers imported classes and ultimately a module reference to os. The sandbox must therefore block attribute traversal, not just builtins.

Question 26Source Code Analysis and Web Application Reconnaissance

During reconnaissance against a target you request `/.git/config` and receive a 200 response containing repository metadata. What is the most useful conclusion for a source code review engagement?

  1. Only commit messages remain recoverable, because Git object files are always stored outside the web-accessible root.
  2. The server must be running the Git daemon on port 9418, so a full clone over the git protocol is guaranteed to succeed.
  3. The response proves the login form is vulnerable to SQL injection, since Git configuration files contain database credentials.
  4. The exposed repository can often be reconstructed, giving the reviewer the application source for offline white-box analysis. Correct answer.

Explanation

An exposed `.git` directory leaks `HEAD`, `config`, refs and loose/packed object files; tooling can rebuild the working tree from those objects. That hands the reviewer the actual deployed source, which is far more valuable than any single inferred bug. The exposure itself proves nothing about SQL injection, and it does not depend on the git daemon being reachable.

Question 27Source Code Analysis and Web Application Reconnaissance

A reviewer follows an attacker-controlled value from an HTTP parameter through assignments and function calls until it reaches a database query. What is this technique called?

  1. Differential fuzzing
  2. Symbolic constraint solving
  3. Taint (data-flow) analysis Correct answer.
  4. Dependency confusion auditing

Explanation

Taint analysis models user input as a source, tracks it through assignments, concatenations and function calls, and flags it when it reaches a sink such as a query or command execution call. It is the core mental model of manual white-box injection hunting. The other options are testing or supply-chain techniques that do not describe tracking a value through code.

Question 28Source Code Analysis and Web Application Reconnaissance

A response from the target includes the header `X-Powered-By: Express` and sets a cookie named `connect.sid`. How should a tester use this during a white-box engagement?

  1. Assume the application cannot be reviewed meaningfully without first recovering the original minified client bundle.
  2. Prioritize JavaScript server-side code: route definitions, `req.query`/`req.body` handling, and `fs` or `child_process` sinks. Correct answer.
  3. Conclude that the application is fronted by an nginx reverse proxy and prioritize review of the proxy configuration.
  4. Treat the application as vulnerable to MongoDB injection, since a `connect.sid` cookie implies Mongoose session storage is in use.

Explanation

`X-Powered-By: Express` and the default `connect.sid` cookie name are framework fingerprints that point to a Node.js/Express server, so the server-side JavaScript is where injection sinks live. Fingerprints narrow the search space; they do not by themselves prove a specific vulnerability class or a particular proxy layer.

Question 29Source Code Analysis and Web Application Reconnaissance

When starting a white-box review of a large MVC application to find injection flaws, which approach most efficiently narrows the search?

  1. Decrypt every password hash in the available database dump before reading any application source files.
  2. Review only the static CSS and template assets first, looking for developer comments that mention injection.
  3. Map the routing table to controller actions, then trace each action's user input toward dangerous sinks. Correct answer.
  4. Read every third-party dependency's source code line by line before examining the application's own code.

Explanation

Routes define the externally reachable surface, so mapping them to handlers and then following their inputs to sinks focuses effort on code an attacker can actually reach. Dependency and asset review may matter later but does not locate reachable injection points. This source-to-sink scoping is the standard first pass in a code review.

Question 30Source Code Analysis and Web Application Reconnaissance

A Node.js service validates a fetch target with `if (!url.includes('trusted.example')) { return res.status(400); }` before calling `fetch(url)`. Why does this check fail to restrict requests to the trusted host?

  1. Because `fetch` normalizes and strips query strings before the comparison, the substring test inspects a different value.
  2. The host `trusted.example.attacker.net` satisfies the substring test but resolves to an attacker-controlled server. Correct answer.
  3. Because `String.prototype.includes` treats its argument as a regular expression, so `.*` matches any host name.
  4. Because the validation call resolves asynchronously after the outbound request has already been dispatched.

Explanation

A substring test asks only whether the trusted text appears anywhere in the URL, so a hostname like `trusted.example.attacker.net` or a path such as `http://attacker.net/?trusted.example` passes while the request goes elsewhere. Safe validation parses the URL and compares the resulting hostname exactly against an allowlist. This substring-vs-hostname mismatch is a common SSRF root cause found in code review.

Question 31Authentication, Session Management, and Access Control Flaws

Which control most directly prevents session fixation after a user authenticates?

  1. Set the session cookie with the Secure attribute
  2. Regenerate the session identifier upon successful login Correct answer.
  3. Increase the session idle timeout value
  4. Store the session identifier in the URL query string

Explanation

Session fixation occurs when an attacker can choose or know a session ID that remains valid after login; issuing a fresh ID on authentication invalidates the attacker's pre-set value. Secure and timeout settings do not change the identifier, and URL storage increases exposure.

Question 32Authentication, Session Management, and Access Control Flaws

Which cookie attribute stops client-side JavaScript from accessing the session cookie?

  1. Path
  2. SameSite
  3. Secure
  4. HttpOnly Correct answer.

Explanation

HttpOnly instructs the browser to hide the cookie from document.cookie, reducing the impact of token theft through XSS. Secure controls transport, SameSite controls cross-site sending, and Path controls URL scope.

Question 33Authentication, Session Management, and Access Control Flaws

What is the recommended way for a web application to store user passwords?

  1. SHA-1 hash with a shared static salt
  2. AES encryption using a hard-coded key
  3. MD5 hash of the password with no salt
  4. A slow salted hash such as bcrypt Correct answer.

Explanation

Passwords should be stored using slow, salted algorithms such as bcrypt, scrypt, or Argon2; salts prevent precomputation and slowness resists cracking. Fast unsalted hashes, static salts, and reversible encryption are unsuitable.

Question 34Authentication, Session Management, and Access Control Flaws

An authenticated user changes /invoice/1001 to /invoice/1002 in the request and receives another customer's invoice. Which flaw is demonstrated?

  1. Missing object-level authorization Correct answer.
  2. Weak session token entropy
  3. Cross-site request forgery
  4. Stored cross-site scripting

Explanation

The application authenticates the user but fails to verify that the requested invoice belongs to that user; this is an object-level access control flaw, often called IDOR or BOLA. CSRF, XSS, and token entropy concern different mechanisms.

Question 35Authentication, Session Management, and Access Control Flaws

A JWT is accepted even after its signature segment is removed and the header says alg none. What does this indicate?

  1. The token uses a weak HMAC secret
  2. The token has expired but is still cached
  3. The server checks the token against a blocklist
  4. The server does not verify the token signature Correct answer.

Explanation

The none algorithm indicates an unsigned token; if the server accepts it, signature verification is effectively disabled, allowing arbitrary claims. A weak secret or caching would not explain acceptance of an unsigned token.

Question 36Authentication, Session Management, and Access Control Flaws

A login form returns 'no such user' for unknown usernames and 'incorrect password' for valid ones. What weakness does this expose?

  1. Clickjacking
  2. Password spraying
  3. Username enumeration Correct answer.
  4. Session fixation

Explanation

Different responses let an attacker determine which usernames exist, enabling targeted password attacks. Session fixation, spraying, and clickjacking are not directly indicated by differential error messages.

Question 37Authentication, Session Management, and Access Control Flaws

What is the effect of marking a session cookie SameSite=Strict?

  1. The cookie is inaccessible to JavaScript
  2. The cookie is encrypted before transmission
  3. The cookie is withheld from cross-site requests Correct answer.
  4. The cookie is limited to a single URL path

Explanation

SameSite=Strict prevents the browser from sending the cookie on cross-site navigations or requests, mitigating CSRF. Encryption, JavaScript access, and path scope are controlled by other attributes.

Question 38Authentication, Session Management, and Access Control Flaws

An assessment finds the administrative console still accepts admin/admin. Which authentication weakness is present?

  1. Broken logout
  2. Password spraying
  3. Default credentials Correct answer.
  4. Credential stuffing

Explanation

Default credentials are factory- or installation-supplied accounts that were never changed, allowing trivial authentication bypass. Credential stuffing and spraying are attack techniques, not the configuration flaw.

Question 39Authentication, Session Management, and Access Control Flaws

A server verifies RS256 JWTs with an RSA public key. An attacker changes alg to HS256 and signs with the public key, and the token is accepted. What is the root cause?

  1. The server uses a weak random number generator
  2. The RSA private key was leaked to the attacker
  3. The token lifetime is longer than permitted
  4. The library uses the public key as the HMAC secret Correct answer.

Explanation

Algorithm confusion occurs when verification code selects the algorithm from the token and uses the same key material for both RSA and HMAC; the public key becomes an HMAC secret. No private key leak or RNG weakness is required.

Question 40Authentication, Session Management, and Access Control Flaws

A JWT header's kid value is concatenated into a file path to load the verification key. Setting kid to ../../../../dev/null and signing with an empty HMAC key is accepted. Why?

  1. The server ignores the kid header entirely
  2. The server fetches keys from an external URL
  3. Path traversal loads an empty file as the key Correct answer.
  4. The token uses an expired kid value

Explanation

If kid is used unsafely in a filesystem path, traversal can point to a file with known or empty contents, which then becomes the HMAC verification key. Ignoring kid, expiry, or external fetches would not produce this result.

Question 41Authentication, Session Management, and Access Control Flaws

A profile update endpoint binds every JSON field to the user object. Sending {"role":"admin"} elevates the account. Which flaw is this?

  1. SQL injection
  2. Mass assignment Correct answer.
  3. Open redirect
  4. Cross-site scripting

Explanation

Mass assignment, or autobinding, occurs when client-supplied fields are bound to internal objects without an allowlist, letting users set sensitive properties like role. The other issues involve script injection, query manipulation, or redirects.

Question 42Authentication, Session Management, and Access Control Flaws

A regular user cannot see an admin link, but requesting /admin/users directly returns the full user list. What weakness is shown?

  1. Cross-site request forgery
  2. Insecure direct object reference
  3. Forced browsing Correct answer.
  4. Session fixation

Explanation

Forced browsing is accessing functionality by guessing or directly requesting URLs that are hidden in the UI but not protected server-side. IDOR would involve a manipulable object identifier, not an unlinked endpoint.

Question 43Authentication, Session Management, and Access Control Flaws

A password-reset token is a six-digit numeric code with no attempt limit. What is the most practical attack?

  1. Brute-forcing the token within its validity window Correct answer.
  2. Recovering the token from the Referer header
  3. Stealing the token via clickjacking
  4. Forging a JWT with alg none

Explanation

A short, low-entropy token without rate limiting can be enumerated during its lifetime. Referer leakage, JWT forgery, and clickjacking target different mechanisms and are not the direct consequence described.

Question 44Authentication, Session Management, and Access Control Flaws

After logout, the browser deletes the session cookie, but replaying the old cookie still grants access. What is missing?

  1. Server-side invalidation of the session Correct answer.
  2. A longer session timeout
  3. The Secure cookie attribute
  4. A CSRF token on the logout form

Explanation

Logout must destroy or revoke the session state on the server; deleting only the client cookie leaves the old identifier valid. Secure, timeout, and CSRF controls do not invalidate server-side sessions.

Question 45Authentication, Session Management, and Access Control Flaws

An API replies with Access-Control-Allow-Origin reflecting any Origin and Access-Control-Allow-Credentials true. What is the impact?

  1. Attackers can execute SQL injection through CORS
  2. The API becomes vulnerable to session fixation
  3. The session cookie becomes accessible to JavaScript
  4. Any website can read authenticated responses Correct answer.

Explanation

Reflecting arbitrary origins with credentials allows a malicious site to make credentialed cross-origin requests and read the responses. CORS does not enable SQL injection, expose HttpOnly cookies to JavaScript, or cause session fixation.

Question 46Authentication, Session Management, and Access Control Flaws

A standard user calls an administrative endpoint and successfully performs admin actions. Which category of access control failure is this?

  1. Insecure direct object reference
  2. Horizontal privilege escalation
  3. Session fixation
  4. Vertical privilege escalation Correct answer.

Explanation

Vertical privilege escalation is gaining rights of a higher-privileged role, such as a user performing admin functions. Horizontal escalation stays at the same role level, and the other options describe different flaws.

Question 47Authentication, Session Management, and Access Control Flaws

PHP code checks if ($storedHash == $userInput) where $storedHash begins with 0e followed by digits. Why can this be bypassed?

  1. Loose comparison treats both values as numeric zero Correct answer.
  2. PHP automatically decrypts the hash
  3. The hash comparison uses a timing side channel
  4. The stored hash is Base64-decoded incorrectly

Explanation

In PHP loose comparison, numeric strings such as 0e123 and 0e456 are both interpreted as zero and compare equal. This is type juggling, not a timing leak, encoding bug, or decryption.

Question 48Authentication, Session Management, and Access Control Flaws

A remember-me cookie stores Base64(username:MD5(password)). An attacker who knows a user's password can generate a valid cookie. What design flaw is present?

  1. The token lifetime is too short
  2. The cookie uses Base64 instead of hex
  3. The cookie lacks the Secure attribute
  4. The token is predictable and not server-bound Correct answer.

Explanation

A remember-me token derived only from known user data can be forged by anyone who can compute the same value; secure designs use random server-side tokens. Transport flags, encoding, and lifetime do not address forgery.

Question 49Authentication, Session Management, and Access Control Flaws

A session identifier is placed in the URL query string. Which risk is most associated with this practice?

  1. The token becomes vulnerable to SQL injection
  2. The identifier leaks via Referer headers and logs Correct answer.
  3. The token is susceptible to CSRF
  4. The cookie is exposed through XSS

Explanation

URLs are frequently logged and sent in Referer headers, so session IDs in query strings leak to third parties. XSS concerns cookie access, SQLi concerns query handling, and CSRF concerns automatic credential sending.

Question 50Authentication, Session Management, and Access Control Flaws

An API compares reset tokens with a byte-by-byte loop that exits at the first mismatch. What attack does this enable?

  1. Algorithm confusion
  2. Token fixation
  3. Timing-based token recovery Correct answer.
  4. Cookie tossing

Explanation

Early-exit comparison makes response time depend on the length of the matching prefix, allowing an attacker to recover the token byte by byte. The other options describe unrelated session or JWT flaws.