GWEB Sample Questions & Answers
Guarding against injected SQL and cross-site scripts through input validation and encoding carries the most weight, alongside web architecture, session security with authentication, limiting access controls, CORS versus CSRF, encryption, API security, and AJAX risks.
Launch the full GWEB simulator →1 free sample.
- Question 1Beginner
Access Control and Authorization · Insecure Direct Object Reference (IDOR)
During a security assessment of a web application, you discover an API endpoint
GET /api/v1/users/{userId}/documentsthat returns a list of documents for a given user. You observe that you can substitute youruserIdwith that of another user and successfully retrieve their document list. The application correctly validates your authentication token for every request. What is the specific vulnerability category that best describes this issue?sequenceDiagram participant Attacker participant API_Gateway as API Gateway participant App_Server as Application Server participant DB as Database Attacker->>API_Gateway: GET /api/v1/users/VICTIM_ID/documents (with Attacker's valid token) API_Gateway->>App_Server: Forward Request (Auth check passes) App_Server->>DB: SELECT * FROM documents WHERE user_id = 'VICTIM_ID' Note right of App_Server: Fails to check if logged-in user matches VICTIM_ID DB-->>App_Server: Returns Victim's documents App_Server-->>API_Gateway: 200 OK with Victim's data API_Gateway-->>Attacker: Response with Victim's dataShow answer & explanation
Correct answer: B
This scenario perfectly describes an Insecure Direct Object Reference (IDOR) vulnerability, which is a type of broken access control. The application authenticates the user correctly but fails to authorize them for the specific resource they are requesting. It uses a direct reference to an object (the
userId) from user-supplied input without verifying that the authenticated user has permission to access that specific object.
Ready for the real thing?
The full GWEB simulator has every exam-style question, timed mode, and instant scoring.