PT0-003: CompTIA PenTest+Demo

Question

A penetration tester performs a web-application assessment and receives the following Set-Cookie value after logging in:

Set-Cookie auth=UGVudGVzdFVzZXI6OTE1MzYK

After analysis, the penetration tester establishes that it is a Base64-encoded string which, when decoded, reads:

Pentestuser:91536 -

The penetration tester logs out, logs in again, and finds that the decoded string now reads:

Pentestuser:91944 -

Which of the following attacks is the penetration tester most likely to conduct based on this information?

A Collision attack
B JWT manipulation
C Session hijacking
D Insecure direct object reference

Explanation

Base64 is reversible encoding, so the cookie exposes a username and an apparently numeric session value. Sequential or otherwise predictable session identifiers can be guessed or enumerated, enabling an attacker to assume another user’s authenticated session; this is session hijacking.

PT0-003: CompTIA PenTest+Demo

AstroTutor

Notes

Readiness

QuestionQ302

Community Discussion