Web and application pentesting: understanding vulnerabilities Quiz

Quiz: authentication weaknesses

Pass mark: 70%. You can retry as many times as you need.

1 Your login form answers “No such user” for unknown accounts and “Wrong password” for known ones. What is the main weakness? Single answer Passwords are stored in clear text User enumeration: the answer reveals which accounts exist The session cookie lacks the Secure attribute The form is vulnerable to clickjacking

2 Which cookie attributes help protect a session cookie? (several answers) Multiple answers possible Secure HttpOnly A very long Expires date SameSite

3 You log in to your lab application and see that the session identifier is identical before and after login. Which risk does this suggest? Single answer SQL injection Weak password policy Session fixation Host header poisoning

4 Which properties should a password reset token have? (several answers) Multiple answers possible Random and long enough to be unguessable Valid for several days so users are not rushed Usable only once and expiring quickly Bound by the server to one account

5 An application asks for the password, then shows a code page. A tester finds that browsing directly to a protected page after the password step works. What is the flaw? Single answer The authenticator app clock is out of sync The second factor can be skipped because the server does not enforce it The password is too short The code is sent by SMS instead of email