nerdexam
CompTIA

PT0-002 · Question #489

A penetration tester is testing a company's public APIs. In researching the API URLs, the penetration tester discovers that the URLs resolve to a cloud-hosted WAF service that is blocking the…

The correct answer is C. Use multiple source IP addresses for the attack traffic to prevent being blocked. When a cloud-hosted WAF is blocking attack attempts, a penetration tester should employ multiple source IP addresses to bypass its rate limiting and IP-based blocking mechanisms.

Attacks and Exploits

Question

A penetration tester is testing a company's public APIs. In researching the API URLs, the penetration tester discovers that the URLs resolve to a cloud-hosted WAF service that is blocking the penetration tester's attack attempts. Which of the following should the tester do to best ensure the attacks will be more successful?

Options

  • AIncrease the volume of attacks to enable more to possibly slip through.
  • BVary the use of upper and lower case characters in payloads to fool the WAF.
  • CUse multiple source IP addresses for the attack traffic to prevent being blocked.
  • DLocate the company's servers that are hosting the API and send the traffic there.

How the community answered

(32 responses)
  • A
    6% (2)
  • B
    13% (4)
  • C
    78% (25)
  • D
    3% (1)

Why each option

When a cloud-hosted WAF is blocking attack attempts, a penetration tester should employ multiple source IP addresses to bypass its rate limiting and IP-based blocking mechanisms.

AIncrease the volume of attacks to enable more to possibly slip through.

Increasing the volume of attacks against a WAF is likely to trigger rate limiting and DDoS protection more quickly, leading to increased blocking rather than success.

BVary the use of upper and lower case characters in payloads to fool the WAF.

While varying character casing can sometimes bypass simple signature-based WAF rules, modern WAFs use more sophisticated detection, making this a less effective and unreliable general strategy.

CUse multiple source IP addresses for the attack traffic to prevent being blocked.Correct

Cloud-hosted WAFs often implement rate limiting or block known malicious IP addresses. By rotating through multiple source IP addresses, a penetration tester can evade these WAF defenses, making it harder for the WAF to identify and block the attack traffic based on source reputation or volume from a single origin.

DLocate the company's servers that are hosting the API and send the traffic there.

Locating the company's origin servers to send traffic directly is a highly effective WAF bypass technique, but cloud-hosted WAFs are specifically designed to obscure origin IPs, making this often difficult or impossible without misconfigurations, and thus not a guaranteed or "best ensure" method in all scenarios.

Concept tested: WAF bypass techniques - IP rotation

Source: https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/06-Testing_for_WAF_Bypasses

Topics

#WAF bypass#Evasion techniques#API security#Cloud security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PT0-002 Practice