CEH Network and Web Application Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  JWT 'none' algorithm vulnerability

  Why this is correct

  The tester changed the 'alg' header to 'none' and the server accepted the token without a signature. This exploits a misconfiguration where the server trusts the 'alg' header and does not enforce a secure algorithm, allowing unsigned tokens. This is a specific JWT vulnerability often called the 'none' algorithm attack, which directly matches the scenario.

• ✗

  JWT algorithm confusion attack

  Why it's wrong here

  Algorithm confusion typically involves switching from an asymmetric algorithm like RS256 to a symmetric one like HS256, using the public key as the HMAC secret. In this scenario, the tester changed the algorithm to 'none', which is a different flaw where the server fails to enforce signature verification. This is not a confusion between RS256 and HS256, so this option does not match the observed behavior.

• ✗

  JWT weak signing key

  Why it's wrong here

  A weak signing key would allow the tester to crack the secret and forge a valid token, but here the tester did not successfully crack the key; instead, the token was modified to remove the signature. The acceptance of an unsigned token indicates a failure to validate the algorithm, not a weak key. Thus, this option does not explain the successful privilege escalation.

• ✗

  JWT token replay attack

  Why it's wrong here

  A replay attack involves capturing a valid token and reusing it later, but the tester here modified the token's payload and header. The server accepted the altered token, which is not a replay of a legitimate token. Therefore, this option is incorrect because the attack involved tampering, not replaying an unchanged token.

Go deeper

Related to this question