A penetration tester is conducting an assessment of an organization that has both a web and mobile application. While testing the user profile page, the penetration tester notices that additional…

Question

Options

• ACompare PI I from data leaks to publicly exposed user profiles.
• BTarget the user profile page with a denial-of-service attack.
• CTarget the user profile page with a reflected XSS attack.
• DCompare the API response fields to GUI fields looking for PH.

• A
  5% (2)
• B
  13% (5)
• C
  3% (1)
• D
  79% (30)

Explanation

Explanation:When additional data is returned in the API response that is not displayed in the web user interface, it indicates that there might be sensitive data being transmitted that is not intended for user display. By comparing the fields returned in the API response to those that are visible in the GUI, a penetration tester can identify any Personally Identifiable Information (PII) or other sensitive data that might be exposed unintentionally. This method is direct and does not involve attacking the system but rather analyzing the data being transmitted. The other options do not directly address the identification of sensitive data in API responses.

No community discussion yet for this question.