GCIH Exploiting Insecure Web App References — 15 Questions

Question 1

Which of the following is a primary indicator that an application is vulnerable to Insecure Direct Object Reference (IDOR)?

Accepted Answer

The presence of sequential numeric IDs in URLs. The hallmark of IDOR is the exposure of internal identifiers in the URL or request body that map directly to database objects. When an application accepts these identifiers without performing secondary authorization checks, it allows users to access resources outside their scope. Recognizing these patterns is vital for incident handlers to determine the scope of unauthorized access during a data breach investigation involving parameter tampering.

Answer

Frequent 500 Internal Server Errors

Answer

The use of encrypted traffic via HTTPS

Answer

The application lacks a login page

Question 2

Which THREE of the following are common consequences of a successful Path Traversal attack?

Accepted Answer

Exposure of sensitive configuration files like web.config or .env. Path traversal attacks provide a gateway to the underlying host, enabling attackers to read sensitive configuration files, capture credentials, or understand the system architecture. By escaping the document root, an attacker gains visibility into files that are logically separated from the web content. This is a severe vulnerability because it can lead to full system enumeration and subsequent privilege escalation, often serving as the initial entry point for more sophisticated attacks.

Answer

Bypassing WAF rules through encryption

Answer

Automated SQL injection of the back-end database

Question 3

Which TWO of the following steps are critical for a secure implementation of file downloads in a web application?

Accepted Answer

Canonicalizing the file path before access. Secure file downloads must combine filename abstraction and strict directory validation to prevent traversal. By separating the user-facing name from the actual storage path and validating that the resulting file path is confined to the intended directory, the application mitigates the risk of unauthorized file system access. These layers provide defense-in-depth, ensuring that even if one control is bypassed, the system remains protected from direct file path manipulation.

Answer

Encoding filenames using URL encoding

Answer

Restricting access to files using OS-level permissions

Answer

Disabling directory listing on the web server

Question 4

An attacker uses a non-sequential, randomly generated ID to access resources, but is still successful in an IDOR attack. What does this suggest about the application's design?

Accepted Answer

The ID was leaked through other channels. The success of the attack despite using randomized IDs proves that the vulnerability is not caused by ID predictability, but by a total absence of server-side authorization checks. Attackers often find these IDs through other means, such as logs, referer headers, or client-side code exposure. Relying on 'security by obscurity' through random IDs is not a substitute for robust access control; the server must validate authorization regardless of how the ID was obtained.

Answer

The random ID generator is cryptographically weak

Answer

The server failed to use HTTPS

Answer

The application is vulnerable to SQL injection

Question 5

Why does using an allow-list for file extensions fail to stop Path Traversal attacks?

Accepted Answer

The filter only checks the end of the filename. An allow-list for file extensions only validates the end of the filename (e.g., '.pdf'), not the path itself. An attacker can still use '..' to traverse the directory structure and access any file, provided they append the allowed extension (e.g., 'etc/passwd%00.pdf'). This bypasses the filter because the server-side logic processes the full path, proving that extension validation is ineffective against directory traversal attacks that manipulate the path before the file is even read.

Answer

The extension filter is bypassed by HTTPS

Answer

It prevents the server from reading files

Answer

It conflicts with the OS file system permissions

Question 6

You are responding to an incident involving a Java web application that streams reports to users. The endpoint accepts a `report` parameter and passes it to `new File(baseDir, report)` before reading the file. Logs show a request containing `%252e%252e%252f` in the parameter, and the response contained the contents of a configuration file outside the base directory. The application's input filter rejects the literal string `../` but nothing else. Which weakness in the filter most directly explains the successful escape?

Accepted Answer

The filter performs a single decoding pass, so double-encoded traversal sequences survive the check and are decoded again by the servlet container before the file path is constructed.. Double encoding defeats filters that inspect a parameter only once. The container decodes `%252e%252e%252f` to `%2e%2e%2f` during initial parsing, and the application's subsequent decoding or path resolution produces `../`. Because the filter checks the string before that final decoding, it never sees the traversal. The correct remediation is to canonicalize the fully decoded path and verify it remains inside the intended base directory.

Answer

The filter only blocks forward slashes, so backslash-based traversal sequences such as `..\` bypass the check on the Linux host.

Answer

The filter runs before authentication, so unauthenticated users can supply traversal sequences that authenticated users cannot.

Answer

The filter compares the parameter against a blocklist of known attack strings instead of validating the final canonical path against the base directory.

Question 7

A web application uses a JSON Web Token (JWT) for session management. The token is signed with the HS256 algorithm. A security tester captures a token and notices that the payload contains a `role` claim set to `user`. The tester attempts to modify the `role` to `admin` but the signature verification fails. The tester then changes the algorithm header to `none` and removes the signature. The modified token is accepted by the server, granting administrative access. Which vulnerability has been exploited?

Accepted Answer

JWT algorithm confusion, where the server accepts the `none` algorithm.. The tester exploited a JWT algorithm confusion vulnerability by changing the algorithm to `none` and removing the signature. The server accepted the token, allowing privilege escalation. The other options describe different attacks: brute-forcing the key, CSRF, and IDOR, none of which match the manipulation of the JWT header to bypass signature verification.

Answer

JWT signature bypass via HMAC key brute-forcing.

Answer

Cross-site request forgery (CSRF) due to lack of token binding.

Answer

Insecure Direct Object Reference (IDOR) in the JWT payload.

Question 8

An attacker manipulates a URL parameter `?file=invoice_123.pdf` to `?file=../../etc/passwd` on a web server. The application successfully returns the sensitive system file content. Which vulnerability is being exploited?

Accepted Answer

Path Traversal. This scenario describes a Path Traversal attack, where an application fails to validate user input used to construct file system paths. By using dot-dot-slash notation, the attacker escapes the intended directory to access unauthorized files. This represents a critical failure in input validation and access control, commonly leading to full system compromise or sensitive data exposure, necessitating robust file path normalization and strictly defined allow-lists.

Answer

Cross-Site Request Forgery

Answer

SQL Injection

Answer

Server-Side Request Forgery

Question 9

Which TWO of the following practices are the most effective at mitigating Insecure Direct Object Reference (IDOR) vulnerabilities?

Accepted Answer

Implementing server-side authorization checks for every object access. Mitigating IDOR requires shifting from user-controlled identifiers to server-side access control checks. Relying on unpredictable identifiers makes guessing harder, but verifying identity and authorization for every requested object is the primary defense. These practices ensure that even if an attacker discovers a valid ID, they lack the authorization to perform operations on the underlying data, thereby closing the logical gap that allows unauthorized object access.

Answer

Increasing the length of session tokens

Answer

Employing a Web Application Firewall (WAF)

Answer

Moving all sensitive data to a cloud storage bucket

Question 10

When auditing an application for Insecure Direct Object References, why is it recommended to perform tests using two distinct user accounts?

Accepted Answer

To confirm that the application does not validate object ownership. Testing with two accounts allows the auditor to verify if User A can access User B's resources using the same identifiers. This 'cross-account' test is the gold standard for confirming an IDOR vulnerability. It isolates the logic flaw by demonstrating that the application fails to validate ownership, proving that access control is tied only to authentication rather than granular authorization, which is a critical finding for secure development.

Answer

To verify if the server is load balanced

Answer

To ensure that session cookies are not reused

Answer

To test the strength of the password hashing

Question 11

An application uses a Base64 encoded string as a parameter for object references. An attacker decodes the string, modifies the ID, re-encodes it, and successfully accesses unauthorized data. Why did the security control fail?

Accepted Answer

Base64 encoding is inherently reversible. The failure occurred because the application relied on encoding (Base64) as a security control instead of proper authorization logic. Encoding is a data representation technique, not a security mechanism. Because the server failed to perform access control checks on the decoded identifier, it allowed the attacker to bypass the intended security model. This highlights the importance of never confusing data format obfuscation with actual authorization or identity management.

Answer

The server failed to enforce HTTPS

Answer

The session token was not included in the payload

Answer

The application used an insecure hashing algorithm

Question 12

Which of the following is the most secure method for handling file references in a web application to prevent path traversal?

Accepted Answer

Using indirect references via a database lookup. The most secure method is to use indirect references, such as a database lookup, where the user-supplied input maps to a predefined index or key. This prevents the user from ever providing a raw file path or directory structure to the server. By abstracting the file system, the application maintains complete control over which files are accessible, effectively eliminating the possibility of traversal attacks by design.

Answer

Sanitizing input by removing '..' sequences

Answer

Encrypting the file path in the URL

Answer

Allowing only alphanumeric characters in the filename

Question 13

Which of the following is the most critical step to perform after detecting a successful IDOR exploit?

Accepted Answer

Audit access logs to assess the scope of data exposure. The most critical step is to perform a comprehensive audit to determine the scope of unauthorized access. Since IDOR exploits are often automated, an attacker could have scraped the entire database. Identifying which user records were exposed is essential for compliance, incident reporting, and notifying affected parties. Without a thorough impact assessment, you cannot quantify the damage or ensure the vulnerability has not been used to exfiltrate bulk sensitive data.

Answer

Restart the web server service

Answer

Block the attacker's IP address on the firewall

Answer

Rotate all user passwords in the system

Question 14

How can an application distinguish between an authorized user requesting their own profile and an unauthorized user attempting to access a different profile via IDOR?

Accepted Answer

By verifying ownership of the requested resource in the backend. The application must correlate the authenticated user's identity (from the session) with the requested resource identifier on the back-end. By checking if the session user owns the requested resource ID before returning data, the application enforces authorization. This moves the logic from 'is this user allowed to access anything?' to 'is this user allowed to access THIS SPECIFIC object?', which is the foundation of secure resource access control.

Answer

By validating that the user has a session cookie

Answer

By checking if the resource ID is a valid integer

Answer

By using a CAPTCHA on every request

Question 15

Which of the following describes the core difference between Path Traversal and IDOR?

Accepted Answer

Path Traversal is an OS-level vulnerability, while IDOR is an application-level flaw. Path Traversal targets the file system by manipulating paths to access arbitrary files, whereas IDOR targets application data by manipulating identifiers to access unauthorized database objects. While both involve parameter tampering, they operate at different layers: Path Traversal interacts with the underlying OS file structure, while IDOR interacts with the application's data model. Understanding this distinction is key to selecting the appropriate remediation strategy for each specific vulnerability.

Answer

IDOR is only applicable to RESTful APIs

Answer

Path Traversal is only possible on Windows systems

Answer

IDOR is a subtype of Path Traversal