Web Security Best Practices Quiz

Security Best Practices for Web Applications

• Escape untrusted input to prevent exploitation by converting characters to HTML encoding.
• Set HttpOnly and Secure flags on cookies to restrict access via JavaScript and ensure data is sent only over HTTPS.
• Avoid inline JavaScript and direct embedding of user inputs to mitigate vulnerabilities.
• Regularly conduct automated and manual security tests to identify and address potential XSS vulnerabilities.

Basics of WiFi Networking

• Ad-Hoc Mode:

  • Allows peer-to-peer connections directly between devices, bypassing routers or access points.
  • Ideal for temporary networks, such as file sharing between laptops.
  • No central management; devices communicate independently within range.

• Infrastructure Mode:

  • Devices connect to a central access point (router) that manages network traffic.
  • Common use in homes and offices, providing better range and effective management.
  • Access points help optimize connectivity and traffic handling.

• Monitor Mode:

  • Enables a device to listen to all traffic on a channel without connecting to any network.
  • Used for network analysis, debugging, and security audits—limiting data transmission.

Wireless Security Protocols

• WEP (Wired Equivalent Privacy) was an early security protocol to secure wireless networks but is highly vulnerable.
  • Known weaknesses include a short 24-bit Initialization Vector (IV) and weaknesses in the RC4 encryption algorithm.
  • The integrity check algorithm CRC-32 is also considered weak.

RADIUS Authentication

• RADIUS servers manage authentication and session control for wireless networks.
• Upon successful authentication, these servers help establish encryption keys for securing wireless communications.
• They track usage for accounting and enforce access policies.

File Inclusion Vulnerability

• This vulnerability occurs when attackers manipulate file paths to access unintended files or directories.
• Can lead to unauthorized file access or code execution, posing a serious security threat.
• Prevention strategies include utilizing static file inclusion and avoiding the use of $_GET[] for page parameters.

Wireless Network Security Challenges

• Wireless networks broadcast data over radio waves, making them more susceptible to interception compared to wired networks.
• Attackers can capture signals without physical access, complicating network security.

Wireless Networking Modes Overview

• Ad-hoc mode only requires wireless adapters, making it simple for small networks.
• Infrastructure mode uses an access point (AP) for connectivity, requiring knowledge of the SSID, which can be easily sniffed.
• Monitor mode captures traffic across all nearby wireless networks without connecting.

Authentication Methods in Wireless Networks

• Open System Authentication (OSA):

  • Clients send an authentication request to the access point, including SSID verification.
  • Successful authentication leads to association with the AP for network access.

• Shared Key Authentication:

  • Requires pre-shared keys for client authentication and encrypts traffic post-authentication.

MIC Attack on Four-Way Handshake

• Involves intercepting messages exchanged between the client and AP during the authentication process.
• The Message Integrity Code (MIC) ensures the integrity of messages, calculated using the Pairwise Transient Key (PTK) and client’s nonce.
• Attacker aims to discover the correct PTK by performing a brute-force attack on the Pairwise Master Key (PMK), derived from the pre-shared key.