GCIH Web App API Attacks — 20 Questions

Question 1

Refer to the exhibit. Which security vulnerability is most directly represented by the presence of the 'debug_info' field in the API response?

Accepted Answer

Excessive Data Exposure. The inclusion of raw database queries in an API response is a clear indicator of Excessive Data Exposure. This information disclosure provides an attacker with internal system architecture details, table names, and query structures. This exposure facilitates further attacks like SQL injection by confirming backend schema details, allowing the attacker to craft more precise and damaging payloads during the reconnaissance phase of an attack.

Answer

SQL Injection

Answer

Improper Asset Management

Answer

Broken Object Level Authorization

Question 2

A GCIH incident handler is called to investigate a web application that uses a REST API. The handler observes that the API accepts a 'callback' parameter and reflects its value directly in the JSON response without any sanitization. Which type of attack is most directly enabled by this behavior?

Accepted Answer

JSONP injection leading to cross-site scripting. Reflecting an unsanitized callback parameter into a JSON response is a hallmark of JSONP injection. If the response is served with a JavaScript MIME type or interpreted as script, an attacker can execute arbitrary JavaScript in a victim's browser by crafting a malicious callback value, leading to cross-site scripting.

Answer

Remote code execution via deserialization

Answer

Cross-site scripting (XSS) via JSON hijacking

Answer

Server-side request forgery (SSRF) through callback URLs

Question 3

An incident responder investigates a RESTful API where users can access sensitive records simply by incrementing an integer ID in the endpoint URL, such as changing /api/v1/users/104/profile to /api/v1/users/105/profile without providing additional authorization checks. Which vulnerability class does this scenario represent?

Accepted Answer

Broken Object Level Authorization. This scenario clearly demonstrates Broken Object Level Authorization, where authorization validation is missing in the object identifier tier. Attackers exploit this design flaw to harvest unauthorized records horizontally or vertically. Incident handlers must recognize API1:2023 risks during web application forensics to properly scope data exfiltration incidents and remediate flawed access control logic across microservices.

Answer

Cross-Site Request Forgery

Answer

Server-Side Request Forgery

Answer

Mass Assignment

Question 4

During a web application incident investigation, the SOC analyst discovers that an attacker sent a modified JSON payload containing an unexpected administrative attribute "is_admin": true during user registration, which successfully elevated the user's privileges. What vulnerability enabled this exploitation?

Accepted Answer

Mass Assignment. Mass assignment occurs when frameworks automatically bind user input parameters directly to backend data models without proper filtering. This allows attackers to inject privileged fields that were never intended to be exposed during client-side registration forms. GCIH handlers must trace data binding configurations and ensure explicit allowlisting of updatable attributes to prevent privilege escalation incidents via API request tampering.

Answer

Broken User Authentication

Answer

Server-Side Request Forgery

Answer

Cross-Site Scripting

Question 5

An attacker discovers an API endpoint /api/v1/user/details?id=123 that returns JSON data. They modify the parameter to /api/v1/user/details?id=124. This vulnerability indicates a failure in which security control?

Accepted Answer

Insecure Direct Object Reference. This scenario describes Insecure Direct Object Reference (IDOR). The application fails to verify if the authenticated user has authorization to access the object associated with the ID parameter. In API security, this is a critical flaw because APIs often expose backend database keys directly. Proper mitigation requires server-side access control checks on every request, ensuring the requester owns the resource before returning sensitive data.

Answer

Broken Authentication

Answer

Cross-Site Scripting

Answer

Insufficient Logging and Monitoring

Question 6

Which TWO methods are effective for mitigating Mass Assignment vulnerabilities in RESTful APIs?

Accepted Answer

Implement strict input allow-lists for model binding. Mass Assignment occurs when an API endpoint automatically binds client-provided input to internal data models or database fields without explicit filtering. By using Data Transfer Objects (DTOs) or explicit allow-lists, developers ensure only intended fields are updated. This prevents attackers from overwriting sensitive fields like 'is_admin' or 'account_balance' that should not be exposed to user modification during standard API update operations.

Answer

Always sanitize input for SQL injection patterns

Answer

Increase the complexity of the API authentication token

Answer

Disable all write operations on public API endpoints

Question 7

An API uses OAuth 2.0. An attacker sends a request with a modified 'redirect_uri' parameter to an authorization endpoint. If successful, this could lead to which type of vulnerability?

Accepted Answer

Authorization Code Interception. Manipulating the 'redirect_uri' in an OAuth flow is a classic technique to facilitate Authorization Code Interception. By changing the URI to a domain under the attacker's control, the attacker can cause the authorization server to send the sensitive authorization code to them instead of the legitimate client application, enabling them to exchange the code for an access token and impersonate the user.

Answer

Denial of Service

Answer

Cross-Site Request Forgery

Answer

Server-Side Request Forgery

Question 8

Which THREE items are essential components of an API security documentation strategy for incident responders?

Accepted Answer

Up-to-date OpenAPI/Swagger specifications. Effective incident response for APIs requires comprehensive documentation. API specifications (like OpenAPI/Swagger) provide the baseline for expected behavior and valid endpoints. Inventory documentation ensures all endpoints are known and monitored. Finally, security headers and rate-limiting policies document the defense-in-depth posture. Without these, responders cannot differentiate between legitimate traffic patterns and malicious exploitation attempts during an active security event or during post-incident forensic analysis.

Answer

Hardcoded database credentials for internal services

Answer

Customer personal identifiable information (PII) logs

Question 9

When analyzing a JSON Web Token (JWT) for potential security weaknesses in an API, which scenario indicates a 'None' algorithm attack is possible?

Accepted Answer

The header contains 'alg': 'none'. A 'None' algorithm attack occurs when the JWT header specifies 'alg': 'none'. If the API backend fails to strictly validate the algorithm field and accepts this header, it treats the token as unsigned. An attacker can then modify the payload (e.g., changing 'user_id' to 'admin') and submit the token without a valid cryptographic signature, effectively bypassing authentication controls because the backend skips signature verification for 'none' algorithms.

Answer

The token expires in less than 60 seconds

Answer

The token uses RS256 instead of HS256

Answer

The secret key is stored in an environment variable

Question 10

Which security measure is most effective against API-based Denial of Service (DoS) attacks targeted at resource-intensive endpoints?

Accepted Answer

Implementing robust rate limiting. Rate limiting is the standard defense against resource exhaustion in APIs. By enforcing limits on the number of requests a client can make within a specific timeframe, the API prevents a single user or bot from monopolizing backend CPU, memory, or database connections. This ensures that the service remains available to other legitimate users, mitigating the risk of intentional or accidental system degradation caused by heavy API consumption patterns.

Answer

Enforcing HTTPS for all traffic

Answer

Using JWTs for authentication

Answer

Disabling CORS headers

Question 11

Refer to the exhibit. An attacker changes the 'final_price' to 0.00. What is the most likely vulnerability?

Accepted Answer

Mass Assignment. The exhibit shows a Mass Assignment vulnerability. The API accepts the client-provided 'final_price' instead of calculating it server-side. By exposing internal fields that should be read-only or calculated internally, the API allows the client to influence business logic. In this case, the attacker successfully manipulated the payment amount, demonstrating why sensitive fields must be protected from external modification during request binding processes in the API backend.

Answer

Broken Object Level Authorization

Answer

Command Injection

Answer

Cross-Site Scripting

Question 12

Which of the following is the most significant security risk associated with the use of 'API Keys' for authentication in modern cloud-native environments?

Accepted Answer

They are static secrets prone to leakage. API keys are often static and long-lived, making them highly susceptible to theft through code repository leaks, log exposure, or interception. Once stolen, they are difficult to rotate and often grant broad access. Unlike short-lived tokens like OAuth access tokens, static keys lack expiration, context, and granular scope, creating a significant security burden for organizations that fail to implement strict rotation and revocation procedures for their distributed keys.

Answer

They are easily cracked using brute-force tools

Answer

They cannot be used over HTTPS connections

Answer

They are incompatible with RESTful architecture

Question 13

In the context of API security, what does the 'Broken Object Level Authorization' (BOLA) vulnerability typically involve?

Accepted Answer

Lack of authorization checks on object access. BOLA occurs when an API endpoint uses user-supplied input to access a resource (like a database ID) but fails to check if the requester is authorized to access that specific object. Because APIs often expose internal resource IDs directly, attackers can easily enumerate or modify these IDs to access other users' data, making this one of the most common and damaging vulnerabilities in modern web and mobile API architectures.

Answer

Failure to encrypt sensitive API parameters

Answer

Inability to verify the requester's identity

Answer

Excessive use of third-party API libraries

Question 14

Which THREE actions are recommended to secure APIs against Server-Side Request Forgery (SSRF)?

Accepted Answer

Implement a strict allow-list for URLs. SSRF occurs when an API is tricked into making requests to internal or unauthorized external resources. To prevent this, developers must use strict allow-lists for destination domains, disable unused URL schemes (like file://), and enforce network-level segmentation that restricts the API server's ability to reach internal management interfaces or metadata services. These layers of defense ensure that even if an input parameter is compromised, the server remains isolated from critical internal assets.

Answer

Use a public proxy for all outgoing requests

Answer

Store all API secrets in the URL parameters

Question 15

An incident responder is analyzing an API access log and notices a user with ID 104 is able to modify account settings for user ID 105 by simply changing the integer value in the URI endpoint from /api/v1/users/104/settings to /api/v1/users/105/settings without any additional token validation or role checks. Which specific OWASP API Security Top 10 vulnerability class does this scenario represent?

Accepted Answer

Broken Object Level Authorization resulting from missing access control validation checks on resource identifiers embedded directly within API request paths.. This scenario describes Broken Object Level Authorization, where an API endpoint fails to verify whether the authenticated user possesses the appropriate permissions to access or modify a specific object identifier within the URI. Attackers exploit this design flaw to systematically harvest or alter sensitive data across multiple accounts. Recognizing this architectural failure is vital for incident handlers performing root-cause analysis during data breach investigations involving web applications and modern API microservices.

Answer

Broken Authentication due to weak session token generation algorithms allowing session hijacking across user accounts.

Answer

Mass Assignment vulnerability caused by automatically binding incoming HTTP request parameters to internal backend database object properties.

Answer

Improper Assets Management stemming from exposed documentation and forgotten non-production API endpoints lacking proper security controls.

Question 16

An incident responder is investigating a modern web application and notices that users can modify object identifiers in REST API endpoints to access sensitive records belonging to other tenants. Which primary vulnerability category does this represent?

Accepted Answer

Broken Object Level Authorization. Broken Object Level Authorization occurs when an application fails to properly verify user permissions before granting access to objects based on the provided identifier. Attackers manipulate the ID parameter to view or modify unauthorized data, making this a critical Web App API security flaw requiring strict role-based checks.

Answer

Cross-Site Request Forgery

Answer

Server-Side Request Forgery

Answer

Mass Assignment Vulnerability

Question 17

An incident responder is investigating a RESTful API breach where an authenticated low-privileged user accessed administrative records by modifying an integer identifier in the resource path from /api/v1/users/104 to /api/v1/users/1. Which type of vulnerability has been exploited?

Accepted Answer

Insecure Direct Object Reference. This scenario describes an Insecure Direct Object Reference vulnerability, commonly classified under Broken Object Level Authorization in modern API security taxonomies. The application fails to validate whether the requesting user possesses authorization to access the specific resource identifier requested in the URL path. Attackers systematically enumerate these predictable identifiers to harvest unauthorized sensitive data across multi-tenant API endpoints during security assessments and active breaches.

Answer

Broken Function Level Authorization

Answer

Cross-Site Request Forgery

Answer

Server-Side Request Forgery

Question 18

During a penetration test of a GraphQL API, an incident handler finds that the introspection system is enabled and can be queried without authentication. The handler retrieves the full schema, including hidden fields and mutations. What is the most significant security impact of this finding?

Accepted Answer

Attackers can map the entire API surface, identify sensitive fields and mutations, and craft targeted queries to abuse them.. Exposed GraphQL introspection lets attackers retrieve the full schema, including hidden fields and mutations. This information disclosure enables them to craft precise queries and mutations that target sensitive operations, significantly lowering the effort required for further exploitation. The other options either misstate the technical effect or focus on less likely outcomes. Therefore, schema mapping and targeted abuse is the most significant impact.

Answer

Attackers can directly execute arbitrary code on the GraphQL server through introspection queries.

Answer

Attackers can bypass authentication by sending a specially crafted introspection query that returns valid session tokens.

Answer

Attackers can cause a denial of service by sending an introspection query that recursively expands the schema indefinitely.

Question 19

An incident responder is analyzing a web application that uses a REST API. The API accepts a 'file' parameter that specifies a URL from which to fetch an image. The responder observes that an attacker supplied a URL pointing to an internal metadata service (e.g., http://169.254.169.254/latest/meta-data/) and successfully retrieved sensitive instance credentials. Which vulnerability class does this represent?

Accepted Answer

Server-Side Request Forgery (SSRF). The server fetched a user-supplied URL, which pointed to an internal metadata service, and returned sensitive credentials. This is a Server-Side Request Forgery (SSRF) attack, where the attacker abuses the server's ability to make requests to internal resources. The other options describe different attack vectors that do not involve the server making arbitrary outbound requests based on user input. SSRF is the correct classification.

Answer

Insecure Direct Object Reference (IDOR)

Answer

Cross-Site Request Forgery (CSRF)

Answer

XML External Entity (XXE) injection

Question 20

A GCIH incident handler is reviewing web server logs after a suspected API reconnaissance campaign. The logs show numerous requests to endpoints such as /api/v1/users, /api/v2/users, /api/v3/users, and /api/internal/users, all returning HTTP 404 except one. Which attack technique is most consistent with this pattern?

Accepted Answer

API version enumeration. The pattern of requests to multiple API version prefixes and internal-looking paths, with only one returning a non-404 response, indicates deliberate version and endpoint enumeration. Attackers use this to map the API surface and find versions that may be deprecated, unpatched, or less protected, which then become targets for further exploitation.

Answer

Cross-site scripting (XSS) in API responses

Answer

Server-side request forgery (SSRF) via API parameters

Answer

JWT algorithm confusion attack