312-50 exam dumps: questions 301 to 400 of 473

Correct answer: B

• A. Incorrect.

  Incorrect. CSRF involves tricking an authenticated user’s browser into sending an unwanted request to a vulnerable application. In this scenario, the tester is directly modifying a legitimate request parameter in transit using an intercepting proxy. The core problem is not a missing anti-CSRF control, but the server trusting a client-provided price value.

• B. Correct.

  Correct. This is a classic parameter tampering issue, also called web parameter manipulation. The application relies on client-supplied data such as total_amount instead of recalculating or validating it on the server. In secure web applications, price, discounts, roles, and other security-sensitive values must be derived and enforced server-side, not trusted from hidden fields, cookies, or intercepted requests.

• C. Incorrect.

  Incorrect. Session fixation occurs when an attacker sets or predicts a session identifier and causes the victim to authenticate with that known session ID. Nothing in the scenario involves controlling or fixing the session token. The vulnerability is tied to manipulation of business-critical request parameters, not session establishment.

• D. Incorrect.

  Incorrect. SQL injection occurs when untrusted input is incorporated into SQL queries in an unsafe way, allowing query manipulation. Although the changed value is numeric, the scenario does not show evidence of database query manipulation. The observed impact comes from business logic trusting modified client input, which is distinct from SQL injection.

Correct answer: A

• A. Correct.

  Correct. This scenario is a classic Host header injection issue that results in password reset poisoning. The application improperly trusts the user-supplied Host header when constructing absolute URLs in password reset emails. An attacker can cause the server to generate a valid reset link using an attacker-controlled domain, potentially capturing the victim's reset token and taking over the account.

• B. Incorrect.

  Incorrect. CSRF involves tricking an authenticated user's browser into sending unintended requests to a target application. In this case, the core issue is not the victim's browser performing an unwanted state-changing action, but the server trusting manipulated request metadata to build a password reset URL.

• C. Incorrect.

  Incorrect. SSRF occurs when a server is induced to make outbound requests to attacker-controlled or unintended internal/external resources. Here, the problem is the application reflecting the Host header into an email link, not the server making a backend request to attacker.example.net.

• D. Incorrect.

  Incorrect. Open redirect refers to an application endpoint that forwards or redirects users to a user-controlled destination, typically via a parameter such as next= or url=. In this scenario, the vulnerability is in reset link generation based on the Host header, not an unsafe redirect endpoint.

Correct answer: A

• A. Correct.

  Correct. A password reset confirmation is a state-changing action. If the application authenticates the request using the victim's browser session cookie and does not require a unique, server-validated anti-CSRF token, it may be susceptible to Cross-Site Request Forgery. The absence of Referer validation alone is not the root issue; the main problem is that the application appears to rely on ambient authority from cookies without CSRF-specific protection. In a real assessment, the tester would also verify exploitability by checking whether an attacker can cause the victim's browser to submit the reset request under realistic conditions.

• B. Incorrect.

  Incorrect. Whether a parameter is sent via POST or GET does not determine SQL injection risk. SQL injection depends on unsafe server-side handling of input in database queries. A reset token in a POST body does not inherently indicate SQL injection. This distractor reflects a common misconception that request method alone implies a specific vulnerability class.

• C. Incorrect.

  Incorrect. A reset token can help authorize the password reset process, but it does not automatically prevent CSRF. If an attacker can induce the victim's browser to submit a valid request that includes the token, or if the token is already present in the victim's browser context during the reset flow, the lack of an anti-CSRF mechanism remains a concern. Security depends on how the token is generated, validated, and bound to user actions, not merely on its presence in the request body.

• D. Incorrect.

  Incorrect. Clickjacking and CSRF are different issues. Clickjacking involves tricking a user into interacting with a concealed or framed interface element, typically mitigated with X-Frame-Options or Content-Security-Policy frame-ancestors. Not requiring a Referer header does not by itself demonstrate clickjacking. This option is plausible because both attacks involve browser behavior, but it misclassifies the weakness.

Correct answer: B

• A. Incorrect.

  Incorrect. Although changing a numeric parameter results in access to other database-backed records, this alone does not indicate SQL injection. SQL injection requires unsafe handling of input in database queries, typically allowing alteration of query structure. In this scenario, the key problem is missing authorization on direct object access, not query manipulation.

• B. Correct.

  Correct. This is a classic Insecure Direct Object Reference (IDOR), a type of broken access control where the application exposes a direct reference to an internal object, such as an invoice ID, and fails to enforce authorization checks to confirm the authenticated user is permitted to access that specific object. In modern terminology, this is commonly discussed under broken object-level authorization or broken access control.

• C. Incorrect.

  Incorrect. Session fixation involves forcing or reusing a known session identifier so that a victim authenticates into a session the attacker already knows. Here, there is no evidence of session identifier manipulation. The user remains in their own authenticated session and is abusing weak object authorization by tampering with a resource identifier.

• D. Incorrect.

  Incorrect. CSRF involves tricking an authenticated victim's browser into sending unintended requests to a target application. The presence of a predictable or modifiable parameter does not make this CSRF. In this case, the tester is directly modifying a request in their own session, which points to an authorization flaw rather than a cross-site request forgery issue.

Correct answer: A

• A. Correct.

  Correct. When verbose database errors are suppressed, the appropriate next step is to use controlled boolean-based and/or time-based tests to determine whether the parameter affects backend SQL logic. This aligns with a disciplined web app testing methodology: identify the input vector, observe anomalous behavior, then validate the suspected vulnerability using low-impact techniques before attempting exploitation. For example, comparing responses to conditions that evaluate true versus false, or introducing a small database delay, can confirm SQL injection while respecting scope and minimizing risk.

• B. Incorrect.

  Incorrect. Full automated enumeration is not the best next step because it increases impact and goes beyond confirmation. In a professional assessment, especially when the rules of engagement emphasize minimizing disruption, the tester should first validate the vulnerability with limited, targeted payloads. Enumeration may be appropriate later if explicitly authorized and necessary, but it is not the most methodical or least invasive confirmation step.

• C. Incorrect.

  Incorrect. A 500 error after inserting a single quote may indicate malformed backend processing, including possible SQL injection, but it does not prove reflected input or XSS. Cross-site scripting testing is a different assessment path focused on client-side execution in the browser. Choosing XSS here reflects a common misconception that any input-related error implies browser-side injection, which is not supported by the observed behavior.

• D. Incorrect.

  Incorrect. Session cookie manipulation is unrelated to confirming SQL injection in the q parameter. Also, SQL injection does not require visible database errors to be confirmed; blind techniques exist specifically for cases where applications suppress error details. This option confuses authentication/session attacks with input-validation and server-side query testing.