36 Questions
What happens when a hacker exploits a SQL injection vulnerability?
The hacker can view, modify or delete data.
What is the primary cause of a SQL injection vulnerability?
Insufficient validation of user input.
What is the consequence of viewing confidential personal data in a SQL injection attack?
Loss of confidentiality.
What is the name of the security vulnerability that allows an attacker to inject malicious scripts into a website?
Cross-Site Scripting (XSS)
What is an example of a web application that is vulnerable to Cross-Site Scripting (XSS)?
Message board
What is the primary goal of a hacker exploiting a SQL injection vulnerability?
To gain access to the database.
What is the CIA triad affected by a SQL injection attack?
Confidentiality, Integrity and Availability.
What is the recommended resource for learning more about SQL injection attacks?
W3Schools.
What is necessary to understand before comprehending Broken Authentication Risk?
Session and Cookie concepts
What type of file is a cookie?
Text file
What information can be stored in a cookie file?
Username and viewing preferences
What is the primary purpose of using cookies in e-commerce?
To track user preferences and personalize their experience
How are cookies typically used in online shopping?
To keep track of items in a user's shopping cart
What happens when a user revisits a website that previously sent a cookie?
The browser retrieves the cookie from the hard disk and sends the data to the website
Why do websites often use cookies for targeted advertisements?
To track user preferences
What is not a purpose of using cookies?
To improve website loading time
What is the primary target of an XSS attack?
The users of the web application
What is the main purpose of input validation in preventing XSS attacks?
To verify the type of input submitted by a user
How does an XSS attack typically occur?
When a user loads a legitimate website with malicious code
What is the key difference between XSS and SQL injection attacks?
XSS targets the users, while SQL injection targets the application
What is the primary goal of input validation in preventing XSS attacks?
To ensure the correct type of input is processed
What happens when a user's input passes the validation process?
The input is processed
What is the primary purpose of a cookie in a web application?
To store a user's interests and browsing habits
What happens if you disable cookie use in your browser?
You will not be able to use many e-commerce websites
What is stored on the server-side in a Session?
Information about the user's interaction with the website
What marks the start and end of a user session?
Login and logout from the website
What is the primary goal of a Cross-Site Request Forgery (CSRF) attack?
To perform an action on a trusted website on behalf of the user
What is the impact of a CSRF attack on a user's session?
The user's request is processed as a legitimate request
What is stored on the client-side in a cookie-based authentication?
User's interests and browsing habits
What is the term for the total time used for an activity on a website?
Session
What is the primary mechanism to prevent XSRF attacks?
Using a challenge token or an unpredictable token in the body or URL of each HTTP request
What does CAPTCHA stand for?
Completely Automated Public Turing test to tell Computers and Humans Apart
What is the purpose of MFA (2FA) in security?
To differentiate between real users and unauthorized automated bots
What is the difference between MFA and CAPTCHA?
MFA is for authentication, while CAPTCHA is for differentiating between humans and bots
What is a key characteristic of a challenge token used in XSRF prevention?
It is unique per request
Why is CAPTCHA used in web applications?
To differentiate between humans and automated bots
Study Notes
SQL Injection Attack
- Insufficient security of user information can allow a hacker to alter an app's SQL query code.
- This vulnerability gives an intruder access to the database, enabling them to view, modify, or delete data, steal confidential personal data, and compromise:
- Confidentiality (View)
- Integrity (Modify)
- Availability (Delete)
Cross-Site Scripting (XSS)
- XSS is a security vulnerability found in websites and web applications that accept user input (e.g., search engines, login forms, message boards, and comment boxes).
- An attacker can attach malicious code to a legitimate website, which executes when the victim loads the website.
- XSS targets users of the web application, rather than the application itself.
Prevention Technique for Injection & XSS
- Input validation verifies the type of input submitted by a user to ensure it is allowed.
- Input validation ensures the input is the accepted type, length, format, and so on.
- Only validated input can be processed.
Broken Authentication Risk
- Broken Authentication Risk involves understanding sessions and cookies.
- A cookie is a small text file stored on a user's computer, containing data such as username or viewing preferences.
- Cookies are used to:
- Track user preferences (personalization)
- Store user passwords (login)
- Keep track of items in a user's shopping cart
- Target advertisements (store user interests and browsing habits)
Sessions
- A session is server-side storage of user interaction information with a website or web application.
- Unlike cookies, sessions are stored on the server side.
- A session starts when a user logs in and ends when the user logs out or shuts down the system.
Broken Authentication Risk (continued)
- Cross-Site Request Forgery (CSRF or XSRF) is an attack against cookie-based authentication.
- A CSRF attack involves leading a user to perform an action, sending an HTTP request to a website on behalf of the user.
- If the user has an active authenticated session, the request is processed as a legitimate request sent by the user.
XSRF Prevention
- Preventing XSRF requires using a challenge token or an unpredictable token in each HTTP request.
- Tokens should be unique per user session or request.
- Implementing CAPTCHA on critical pages can also help prevent XSRF attacks.
- MFA (e.g., 2FA) is used for authentication, whereas CAPTCHA is used to differentiate between real users and unauthorized automated bots.
Make Your Own Quizzes and Flashcards
Convert your notes into interactive study material.
Get started for free
