Authentication vulnerability testing in Testing Fundamentals - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Common Weakness in Authentication Systems

Which of the following is the most common authentication vulnerability that allows attackers to bypass login without valid credentials?

A SQL Injection in login form

B Cross-Site Scripting (XSS) in user profile

C Insecure Direct Object Reference (IDOR) in file access

D Open Redirect in logout URL

💡 Hint

Think about how attackers can trick the system into accepting wrong usernames or passwords.

SQL Injection in login forms can allow attackers to manipulate database queries to bypass authentication checks.

❓ Predict Output

intermediate

Output of Authentication Check Code

What is the output of the following Python code simulating a simple password check?

Testing Fundamentals

def check_password(input_password):
    stored_password = 'Pass1234'
    if input_password.lower() == stored_password.lower():
        return 'Access Granted'
    else:
        return 'Access Denied'

print(check_password('pass1234'))

A TypeError

B Access Granted

C Access Denied

D SyntaxError

💡 Hint

Check how the comparison is done with lower() method.

The code compares passwords ignoring case, so 'pass1234' matches 'Pass1234' and grants access.

❓ assertion

advanced

Correct Assertion for Password Length Validation

Which assertion correctly tests that a password string has at least 8 characters?

Testing Fundamentals

password = 'securePass'
# Choose the correct assertion below

A assert password.size >= 8

B assert password.length > 8

C assert len(password) > 8

D assert len(password) >= 8

💡 Hint

Remember Python uses len() function and >= means 'at least'.

Option D uses correct Python syntax and checks for minimum length 8 correctly.

🔧 Debug

advanced

Identify the Bug in Authentication Code

What is the bug in this JavaScript authentication snippet?

Testing Fundamentals

function authenticate(userInput) {
  const password = 'Secret!';
  if (userInput === password) {
    return 'Logged In';
  } else {
    return 'Access Denied';
  }
}
console.log(authenticate('Secret!'));

A Uses assignment (=) instead of comparison (===) in if condition

B Password variable is not declared properly

C Function does not return any value

D Console.log syntax is incorrect

💡 Hint

Check the if condition operator carefully.

The if condition uses '=' which assigns instead of comparing, causing always true and wrong logic.

❓ framework

expert

Best Practice for Testing Authentication Rate Limiting

Which testing approach best verifies that an authentication system properly limits login attempts to prevent brute force attacks?

A Test password reset functionality for valid email

B Manually enter correct password once and verify access

C Automate rapid login attempts with invalid passwords and check for lockout response

D Check UI layout of login page on mobile devices

💡 Hint

Think about how to simulate many wrong tries quickly.

Automated rapid invalid login attempts test if the system blocks further tries, protecting against brute force.