Web Security Best Practices Quiz

Security Best Practices for Web Applications

• Escape untrusted input to prevent exploitation by converting characters to HTML encoding.
• Set HttpOnly and Secure flags on cookies to restrict access via JavaScript and ensure data is sent only over HTTPS.
• Avoid inline JavaScript and direct embedding of user inputs to mitigate vulnerabilities.
• Regularly conduct automated and manual security tests to identify and address potential XSS vulnerabilities.

Basics of WiFi Networking

• Ad-Hoc Mode:

  • Allows peer-to-peer connections directly between devices, bypassing routers or access points.
  • Ideal for temporary networks, such as file sharing between laptops.
  • No central management; devices communicate independently within range.

• Infrastructure Mode:

  • Devices connect to a central access point (router) that manages network traffic.
  • Common use in homes and offices, providing better range and effective management.
  • Access points help optimize connectivity and traffic handling.

• Monitor Mode:

  • Enables a device to listen to all traffic on a channel without connecting to any network.
  • Used for network analysis, debugging, and security audits—limiting data transmission.

Wireless Security Protocols

• WEP (Wired Equivalent Privacy) was an early security protocol to secure wireless networks but is highly vulnerable.
  • Known weaknesses include a short 24-bit Initialization Vector (IV) and weaknesses in the RC4 encryption algorithm.
  • The integrity check algorithm CRC-32 is also considered weak.

RADIUS Authentication

• RADIUS servers manage authentication and session control for wireless networks.
• Upon successful authentication, these servers help establish encryption keys for securing wireless communications.
• They track usage for accounting and enforce access policies.

File Inclusion Vulnerability

• This vulnerability occurs when attackers manipulate file paths to access unintended files or directories.
• Can lead to unauthorized file access or code execution, posing a serious security threat.
• Prevention strategies include utilizing static file inclusion and avoiding the use of $_GET[] for page parameters.

Wireless Network Security Challenges

• Wireless networks broadcast data over radio waves, making them more susceptible to interception compared to wired networks.
• Attackers can capture signals without physical access, complicating network security.

Wireless Networking Modes Overview

• Ad-hoc mode only requires wireless adapters, making it simple for small networks.
• Infrastructure mode uses an access point (AP) for connectivity, requiring knowledge of the SSID, which can be easily sniffed.
• Monitor mode captures traffic across all nearby wireless networks without connecting.

Authentication Methods in Wireless Networks

• Open System Authentication (OSA):

  • Clients send an authentication request to the access point, including SSID verification.
  • Successful authentication leads to association with the AP for network access.

• Shared Key Authentication:

  • Requires pre-shared keys for client authentication and encrypts traffic post-authentication.

MIC Attack on Four-Way Handshake

• Involves intercepting messages exchanged between the client and AP during the authentication process.
• The Message Integrity Code (MIC) ensures the integrity of messages, calculated using the Pairwise Transient Key (PTK) and client’s nonce.
• Attacker aims to discover the correct PTK by performing a brute-force attack on the Pairwise Master Key (PMK), derived from the pre-shared key.

Test your knowledge on essential web security measures to protect against vulnerabilities. This quiz covers critical topics like input sanitization, cookie security, and JavaScript practices. Assess your understanding of security testing and preventive techniques.