PT0-002 Practice Question: A penetration tester is testing a web application…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SQL injection

  Why it's wrong here

  SQL injection is a database-layer attack that works by injecting SQL syntax into user-controlled input to manipulate queries. The JWT algorithm 'none' flaw has nothing to do with SQL; it exploits the token validation process where an attacker modifies the JWT header to 'alg:none' and removes the signature. No SQL statement is executed or altered because the vulnerability targets the authentication middleware's trust in the token header, not a query builder or database interface.

• ✗

  Server-side request forgery

  Why it's wrong here

  Server-side request forgery (SSRF) occurs when an attacker causes the web application to make HTTP requests to arbitrary URLs, often hitting internal services or localhost. In contrast, the JWT 'none' attack is performed entirely by crafting a token on the client side and sending it in the request; the server does not initiate any outbound requests as part of the exploit. The weakness is in signature verification logic, not in server-side URL fetching or request routing, so SSRF does not apply here.

• ✓

  Authentication bypass

  Why this is correct

  Setting the JWT header's algorithm to 'none' and stripping the signature allows the attacker to forge a token with arbitrary claims, such as an administrator username or elevated role. If the server's JWT library accepts unsigned tokens when it should require a signature, the middleware trusts the forged payload and grants access without verifying the token's authenticity. This is a direct authentication bypass because the attacker impersonates any user by simply crafting a valid-looking token, completely circumventing credential validation.

• ✗

  Cross-site request forgery

  Why it's wrong here

  Cross-site request forgery (CSRF) tricks a victim's browser into sending an unintended, authenticated request to a web application, relying on cookies being sent automatically. The JWT 'none' attack is a direct token-forging technique that does not involve the victim's browser, session, or cookies; the attacker creates the malicious token themselves and submits it. It also does not require the victim to perform any action, so the forced-request delivery mechanism of CSRF is irrelevant to this signature-verification flaw.

Go deeper

Related to this question