Web Application Security Testing-PreTest

Which of the following threats is most likely to be caused by poor input validation?

• Enabling of IPSec

• Insecure direct object reference

• Insufficient transport layer protection

• Insecure cryptographic storage

What happens when an application takes user inputted data and sends it to a web browser without proper validation and escaping?

• Security Mis-configuration

• Cross Site Scripting

• Insecure Direct Object Reference

• Broken Authentication and Session Management

An attack technique that forces a user’s session credential or session ID to an explicit value

• Brute Force Attack

• Session Hijacking

• Session Fixation

• Dictionary Attack

What threat arises from not flagging HTTP cookies with tokens as secure?

• Session Hijacking

• Insecure Cryptographic Storage

• Access Control Violation

• Session Replay

How does malicious input flow in a DOM-based XSS?

• From Server to Client

• From Client to Server

• From Attacker to Server

• From Victim to Server

Which attack can execute scripts in the user’s browser and is capable of hijacking user sessions, defacing websites or redirecting the user to malicious sites

• SQL injection

• Cross Site Scripting

• Malware Uploading

• Man in the Middle

What flaw can lead to exposure of resources or functionality to unintended actors?

• Session Fixation

• Improper authentication

• Insecure Cryptographic Storage

• Invalidated redirects and forwards

Role-Based Access control helps prevent this OWASP Top 10 weakness

• Failure to restrict URL Access

• Invalidated Redirect or Forward

• Security Mis-configuration

• Insufficient Transport Layer Protection

What is the type of flaw that occurs when un trusted user entered data is sent to the interpreter as part of a query or command?

• Insecure Direct Object References

• Injection

• Cross Site Request Forgery

• Insufficient Transport Layer Protection

For every link or form which invoke state-changing functions with an unpredictable token for each user what attack can be prevented?

• OS Commanding

• Cross-site Scripting

• Cross-site Request Forgery

• Cross-site tracing