A penetration tester is performing various tests against an application and is repeatedly locked out due to excessive failed log-in attempts. After each attempt, the penetration tester is able to…

The correct answer is B. Business logic flaw. The penetration tester is exploiting a business logic flaw in the application. A business logic flaw occurs when the application does not enforce proper rules or restrictions regarding its intended functionality. In this case: The application allows the creation of multiple…

Attacks and Exploits

Question

A penetration tester is performing various tests against an application and is repeatedly locked out due to excessive failed log-in attempts. After each attempt, the penetration tester is able to create a new account using the same email address with a new username. Which of the following attack vectors is the penetration tester most likely attempting?

Options

ASession fixation
BBusiness logic flaw
CSession replay
DPrivilege escalation

How the community answered

(33 responses)

A
9% (3)
B
73% (24)
C
3% (1)
D
15% (5)

Explanation

The penetration tester is exploiting a business logic flaw in the application. A business logic flaw occurs when the application does not enforce proper rules or restrictions regarding its intended functionality. In this case: The application allows the creation of multiple accounts using the same email address without The application fails to enforce proper protections to lock out or restrict abusive account creation This is not related to session management or privilege escalation but rather a misstep in the application's design and logic that governs how users interact with it. These flaws can be exploited for various purposes, such as bypassing lockouts or abusing system resources.

Topics

#Business logic flaws#Web application security#Account management vulnerabilities#Penetration testing techniques

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice