nerdexam
EC-Council

312-50V12 · Question #245

A penetration tester is conducting an assessment of a web application for a financial institution. The application uses form-based authentication and does not implement account lockout policies…

The correct answer is B. The tester could execute a Brute Force attack, leveraging the lack of account lockout policy and. The most effective attack method is a Brute Force attack, as the application's lack of account lockout policies and detailed error messages directly facilitate unlimited credential guessing and provide valuable feedback to the attacker.

Submitted by carlos_mx· Mar 4, 2026Web Application Hacking

Question

A penetration tester is conducting an assessment of a web application for a financial institution. The application uses form-based authentication and does not implement account lockout policies after multiple failed login attempts. Interestingly, the application displays detailed error messages that disclose whether the username or password entered is incorrect. The tester also notices that the application uses HTTP headers to prevent clickjacking attacks but does not implement Content Security Policy (CSP). With these observations, which of the following attack methods would likely be the most effective for the penetration tester to exploit these vulnerabilities and attempt unauthorized access?

Options

  • AThe tester could exploit a potential SQL Injection vulnerability to manipulate the application's
  • BThe tester could execute a Brute Force attack, leveraging the lack of account lockout policy and
  • CThe tester could execute a Man-in-the-Middle (MitM) attack to intercept and modify the HTTP
  • DThe tester could launch a Cross-Site Scripting (XSS) attack to steal authenticated session

How the community answered

(43 responses)
  • A
    12% (5)
  • B
    56% (24)
  • C
    7% (3)
  • D
    26% (11)

Why each option

The most effective attack method is a Brute Force attack, as the application's lack of account lockout policies and detailed error messages directly facilitate unlimited credential guessing and provide valuable feedback to the attacker.

AThe tester could exploit a potential SQL Injection vulnerability to manipulate the application's

The question does not provide any information or indicators of SQL Injection vulnerabilities, such as unvalidated input or specific error messages related to database interaction.

BThe tester could execute a Brute Force attack, leveraging the lack of account lockout policy andCorrect

A Brute Force attack is highly effective because the absence of an account lockout policy allows an attacker to make an unlimited number of login attempts without penalty. The detailed error messages, which indicate whether the username or password is incorrect, further assist the attacker by providing real-time feedback, enabling them to validate usernames or efficiently guess passwords for known accounts.

CThe tester could execute a Man-in-the-Middle (MitM) attack to intercept and modify the HTTP

A Man-in-the-Middle attack requires the attacker to be positioned between the client and server to intercept traffic, which is not directly facilitated by the application-level vulnerabilities described.

DThe tester could launch a Cross-Site Scripting (XSS) attack to steal authenticated session

While the lack of Content Security Policy (CSP) can make XSS attacks easier to execute if an XSS vulnerability exists, the question does not indicate any specific input fields or conditions that would allow for the injection and execution of malicious scripts.

Concept tested: Brute Force attack enablers in web applications

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/identity-security-best-practices#mitigate-brute-force-attacks

Topics

#Brute force#Web application vulnerabilities#Authentication bypass#Account lockout

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice