GCIH Web App API Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Denial of Service

  Why it's wrong here

  Denial of Service aims to overwhelm or crash the API service. Manipulating redirect parameters is a logic-based exploit focused on authentication bypass or token theft, not service availability. The attack objective is to gain unauthorized access, not to degrade the quality of the service.

• ✗

  Cross-Site Request Forgery

  Why it's wrong here

  CSRF involves tricking a user's browser into performing actions on a different site. While related to authentication, the specific manipulation of OAuth redirect URIs is designed for intercepting authorization codes during the OAuth handshake process, which is fundamentally different from triggering unauthorized state-changing actions via browsers.

• ✓

  Authorization Code Interception

  Why this is correct

  By modifying the redirect_uri to an attacker-controlled endpoint, the authorization server redirects the user's browser with the authorization code sent to the attacker. The attacker then exchanges this code for a valid access token, bypassing standard authentication flows and gaining full access to the victim's account.

• ✗

  Server-Side Request Forgery

  Why it's wrong here

  SSRF occurs when an attacker forces the server to make requests to unintended locations. Redirect URI manipulation happens on the client-side authorization flow and does not force the backend server to perform requests against internal infrastructure; it merely directs the user's browser agent to a malicious destination.