CAS-003 · Question #82
Ann is testing the robustness of a marketing website through an intercepting proxy. She has intercepted the following HTTP request: POST /login.aspx HTTP/1.1 Host: comptia.org Content-type…
The correct answer is C. Remove the txtPassword post data and change alreadyLoggedIn from false to true. The text "txtUsername=ann&txtPassword=ann" is an attempted login using a username of ann' and also a password of ann'. The text "alreadyLoggedIn=false" is saying that Ann is not already logged in. To test whether we can bypass the authentication, we can attempt the login…
Question
Ann is testing the robustness of a marketing website through an intercepting proxy. She has intercepted the following HTTP request:
POST /login.aspx HTTP/1.1 Host: comptia.org Content-type: text/html txtUsername=ann&txtPassword=ann&alreadyLoggedIn=false&submit=true Which of the following should Ann perform to test whether the website is susceptible to a simple authentication bypass?
Options
- ARemove all of the post data and change the request to /login.aspx from POST to GET
- BAttempt to brute force all usernames and passwords using a password cracker
- CRemove the txtPassword post data and change alreadyLoggedIn from false to true
- DRemove the txtUsername and txtPassword post data and toggle submit from true to false
How the community answered
(50 responses)- A10% (5)
- B6% (3)
- C62% (31)
- D22% (11)
Explanation
The text "txtUsername=ann&txtPassword=ann" is an attempted login using a username of ann' and also a password of ann'. The text "alreadyLoggedIn=false" is saying that Ann is not already logged in. To test whether we can bypass the authentication, we can attempt the login without the password and we can see if we can bypass the `alreadyloggedin' check by changing alreadyLoggedIn from false to true. If we are able to log in, then we have bypassed the authentication check.
Topics
Community Discussion
No community discussion yet for this question.