312-50 Question 312
Single answer▪ Bypass Client-Side ControlsDuring an authorized web application assessment, you find an account profile page where the browser disables the "Save" button until the phone number matches a JavaScript regex and the age field is between 18 and 65. The tester's goal is to determine whether these restrictions are enforced only in the browser or also on the server. Which action is the MOST appropriate next step to verify a client-side control bypass?
- A
Intercept the profile update request with a proxy, modify the parameters to invalid values, and forward the request to observe the server response
- B
Disable JavaScript in the browser and conclude the application is vulnerable if the form no longer validates locally
- C
Run a network port scan against the web server to identify whether input validation services are exposed
- D
Capture the page source and search for the regex pattern to prove the validation is only client-side
Show answer and explanation
Correct answer: A
Explanation
The scenario focuses on bypassing client-side controls, a common web application testing task in CEH-relevant assessments. Client-side controls such as disabled buttons, JavaScript regex checks, hidden fields, or HTML5 input constraints are useful for user experience but cannot be trusted for security because the client is under attacker control. The correct approach is to intercept and modify the HTTP request before it reaches the server, then assess how the server processes unexpected or invalid values. This aligns with OWASP guidance that input validation must be performed on the server side and that client-side validation should be treated only as a usability feature, not a security boundary. In practice, testers use intercepting proxies to tamper with parameters, replay requests, and confirm whether the application enforces validation, authorization, and business rules on the backend.
- A. Correct.
Correct. Using an intercepting proxy such as Burp Suite to alter the submitted parameters is the proper way to test whether validation is enforced server-side. Client-side controls can often be bypassed by modifying requests directly, so the key verification step is to send tampered input to the server and evaluate whether the server accepts, rejects, or sanitizes it.
- B. Incorrect.
Incorrect. Disabling JavaScript can help demonstrate that browser-side validation is present, but it does not prove the server is vulnerable. A secure application should still validate all input on the server. Concluding vulnerability without testing the server response is a common mistake.
- C. Incorrect.
Incorrect. A port scan does not test form validation logic and is unrelated to determining whether specific input restrictions are enforced server-side. This option reflects a misunderstanding between network reconnaissance and application-layer validation testing.
- D. Incorrect.
Incorrect. Viewing source code may reveal client-side validation logic, such as regex checks or disabled form elements, but that alone does not establish whether equivalent validation exists on the server. Many secure applications implement both client-side and server-side validation.