312-50 Question 311
Single answer▪ Analyze Web ApplicationsDuring a sanctioned assessment of an e-commerce web application, you intercept the following HTTP request in Burp Suite after submitting a product review:\n\nPOST /review HTTP/1.1\nHost: shop.example.com\nContent-Type: application/x-www-form-urlencoded\nCookie: sessionid=8f3...\n\nproduct_id=442&rating=5&comment=Great+item%21&returnUrl=%2Fproducts%2F442\n\nThe server responds with a 302 redirect to the value of returnUrl. To determine whether this parameter introduces a meaningful web application risk, which action should you take FIRST?
- A
Change returnUrl to https://attacker.example.net and observe whether the application redirects the browser to the external site
- B
Replace returnUrl with ../../../../etc/passwd to test whether the application is vulnerable to directory traversal
- C
Increase rating to 999999 and comment length to 10,000 characters to test for integer overflow and buffer overflow
- D
Remove the session cookie and resend the request to determine whether the review endpoint is vulnerable to SQL injection
Show answer and explanation
Correct answer: A
Explanation
The key to analyzing web applications effectively is to map test cases to observed application behavior. Here, the parameter name returnUrl and the 302 redirect strongly indicate a potential open redirect condition. The most appropriate first step is to modify that parameter to an external URL and verify whether the application places it into the Location header or otherwise redirects the user off-site. This is a practical CEH-style assessment decision: start with the most likely vulnerability indicated by the request/response flow rather than unrelated tests. Open redirect testing is commonly discussed in web security guidance such as the OWASP Web Security Testing Guide and OWASP materials on unvalidated redirects and forwards. If confirmed, the tester should then document impact in context, such as phishing facilitation, bypass of user trust, or abuse in authentication and redirect workflows if applicable.
- A. Correct.
Correct. A parameter named returnUrl that is reflected into a 302 Location header should first be tested for open redirect by supplying an external URL and observing whether the application redirects to it. This is the most direct, evidence-based way to validate the suspected issue from the traffic you already captured. Open redirects are relevant because they can aid phishing, token leakage in some flows, and redirect-chain abuse if other controls are weak.
- B. Incorrect.
Incorrect. Directory traversal testing targets file path handling, typically in parameters used to reference files or directories. In this scenario, returnUrl is used in an HTTP redirect after form submission, so testing traversal first does not align with the observed behavior of the application.
- C. Incorrect.
Incorrect. This option jumps to unrelated input-stress testing. While input validation is important, nothing in the scenario suggests numeric processing flaws or native memory corruption. Modern web applications handling form fields like rating and comment are far more likely to expose logic or injection issues than classic buffer overflows from simple form submissions.
- D. Incorrect.
Incorrect. Removing the session cookie may help test authentication or authorization behavior, but it does not meaningfully assess whether returnUrl is unsafe. SQL injection testing would focus on server-side query construction, and there is no indication here that the redirect parameter is used in a database query.