Tap what belongs to the named risk

Exercise and reference answers

Questions

1. Items

   1. Text

      IDOR on an invoice

      Matches the category

      Yes

   2. Text

      String built SQL

      Matches the category

      No

   3. Text

      Reaching /admin

      Matches the category

      Yes

   4. Text

      Missing API check

      Matches the category

      Yes

   5. Text

      Hardcoded key

      Matches the category

      No

   6. Text

      Public S3 bucket

      Matches the category

      No

   Category

   Broken access control

2. Items

   1. Text

      Weak MD5 hashing

      Matches the category

      No

   2. Text

      SQL injection

      Matches the category

      Yes

   3. Text

      Reflected XSS

      Matches the category

      Yes

   4. Text

      Default password

      Matches the category

      No

   5. Text

      No access check

      Matches the category

      No

   6. Text

      Stored XSS

      Matches the category

      Yes

   Category

   Injection

Instructions

Tap only the items that fit the risk named above, first broken access control, then injection.

Explanation