PT0-001 · Question #47
An engineer, who is conducting a penetration test for a web application, discovers the user login process sends from field data using the HTTP GET method. To mitigate the risk of exposing sensitive…
The correct answer is A. HTTP POST method. HTTP GET appends form data to the URL, exposing sensitive credentials in browser history and server logs, while HTTP POST transmits data in the request body.
Question
An engineer, who is conducting a penetration test for a web application, discovers the user login process sends from field data using the HTTP GET method. To mitigate the risk of exposing sensitive information, the form should be sent using an:
Options
- AHTTP POST method.
- BHTTP OPTIONS method.
- CHTTP PUT method.
- DHTTP TRACE method.
How the community answered
(17 responses)- A88% (15)
- B6% (1)
- D6% (1)
Why each option
HTTP GET appends form data to the URL, exposing sensitive credentials in browser history and server logs, while HTTP POST transmits data in the request body.
HTTP POST sends form data in the message body rather than appending it to the URL as query parameters. This prevents sensitive information such as passwords from appearing in browser history, server access logs, or HTTP Referer headers, which directly mitigates the exposure risk introduced by using GET for login forms.
HTTP OPTIONS is used to describe the communication options available for a target resource and is not designed for submitting form data.
HTTP PUT is intended to create or replace a resource at a specific URI and is not a suitable method for submitting user login credentials.
HTTP TRACE is a diagnostic method that echoes the incoming request back to the client and must not be used for form submission as it can expose credentials to cross-site tracing attacks.
Concept tested: HTTP POST vs GET for sensitive form data
Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/POST
Topics
Community Discussion
No community discussion yet for this question.