30 Questions
Which element in HTML5 is used as a grouping of content, e.g. chapters or tabbed pages?
What does the 'autoplay' attribute in HTML5 video element indicate to the browser?
Start downloading the video file as soon as the page loads and play it automatically as soon as possible
Which HTML5 element is used for multimedia content and supports audio and video natively?
What is the purpose of the element in HTML5?
To define navigation links
Which HTML5 element is used to define self-contained content, such as a blog post or a newspaper article?
What is the purpose of the element in HTML5?
To define the header of a document or a section
What is the purpose of the TOR network?
To provide an anonymous path between users and the sites they visit
Which type of web is accessible only to those who use TOR software?
Dark Web
What was the significant feature of the Stuxnet worm?
It was the first to include Programmable Logic Controller (PLC) rootkit
Which company experienced a significant breach involving credit card users' data?
Equifax
What is the main characteristic of the Invisible Web?
Can only be accessed by individuals with logins for the websites
What is the purpose of Onion routing in the TOR network?
To conceal a user's location and usage from network surveillance
What type of cyber attack involves using altered versions of viruses?
Malware
Which type of attack involves denying access to files and demanding ransom payments?
Ransomware
What is a common vulnerability in web security related to user credentials?
Weak passwords
Which notorious international group is responsible for major cyber attacks?
Anonymous
What method involves using spam emails to gain control of accounts?
Phishing
What type of attack involves automated trial and error to guess user credentials?
Brute force attacks
What feature of HTML5 supports complex graphical operations and animations within the browser?
Canvas
Which HTML5 feature allows users to share their physical location with web applications?
Geolocation
What aspect of HTML5 is crucial due to the high prevalence of vulnerabilities in websites?
Web security
Which HTML5 feature is particularly popular for game development?
Canvas and WebGL
What does HTML5 provide for consistent user experience across browsers and devices, including mobile?
Cross-platform compatibility
Which HTML5 capability enables more efficient, faster-loading web pages and mobile optimization features like touch events?
Improved parsing rules
What is Diceware used for?
Creating secure passphrases
What did Bill Burr regret recommending in the NIST 2003 password guidelines?
Passwords with uppercase and lowercase letters, numbers, special characters, and a minimum of 8 characters
What is the primary defense mechanism to stop Cross-site scripting (XSS)?
Contextual output encoding/escaping
How can mitigations for XSS be achieved?
Tying session cookies to the user's IP address and using the HttpOnly flag
What is the primary purpose of JSON with Padding (JSONP)?
Bypassing the same-origin policy by using JSON in combination with the script tag
What does Injection attacks, including SQL/LDAP/XPATH/SOAP/JSON Injection, occur due to?
Improper validation of user input
Study Notes
Web Security Threats and Solutions
- Diceware is a method for creating secure passphrases by rolling a dice to select words from a list of 7,776 English words.
- Bill Burr, the original author of NIST 2003 password guidelines, regrets recommending passwords with uppercase and lowercase letters, numbers, special characters, and a minimum of 8 characters.
- Session prediction/hijacking involves impersonating a website user by compromising their session ID or cookies.
- Cross-site scripting (XSS) is a vulnerability in web applications that allows attackers to inject client-side scripts and bypass access controls.
- Contextual output encoding/escaping is the primary defense mechanism to stop XSS, but many web applications still rely on session cookies for authentication.
- Mitigations for XSS include tying session cookies to the user's IP address and using the HttpOnly flag to prevent client-side scripts from accessing cookies.
- Browser and plugin vulnerabilities, such as Java/ActiveX/Flash/Acrobat, can enable various attacks and need to be patched by vendors.
- Clickjacking is a method used by malicious individuals to trick users into clicking on invisible iframes positioned above clickable buttons on a website.
- Injection attacks, including SQL/LDAP/XPATH/SOAP/JSON Injection, occur when an application does not properly validate user input.
- JavaScript Hijacking allows unauthorized attackers to read confidential data from a vulnerable application by bypassing the Same Origin Policy using a dynamic script tag.
- Search worms automate finding vulnerable web servers by sending carefully crafted queries to search engines, evading common detection methods.
- JSON with Padding (JSONP) is a way to bypass the same-origin policy by using JSON in combination with the script tag, allowing the execution of information from the server.
Test your knowledge of web security threats and solutions with this quiz. Explore concepts such as Diceware passphrases, session prediction/hijacking, cross-site scripting (XSS) vulnerabilities, clickjacking, injection attacks, and more. Learn about defense mechanisms and mitigations to safeguard against these threats.
Make Your Own Quizzes and Flashcards
Convert your notes into interactive study material.
Get started for free
