Web Application Security Testing-PostTest

What happens when an application takes user inputted data and sends it to a web browser without proper validation and escaping

• Security Mis-configuration

• Cross Site Scripting

• Insecure Direct Object References

• Broken Authentication and Session Management

Which character is most likely to be used for an SQL injection attack

• Single quote (')

• Null (\0) byte

• Less than sign(<)

• Greater than sign(>)

Which of the following attacks occurs when a malicious user convinces a victim to send a request to a server with malicious input and the server echoes the input back to client?

• Reflected XSS

• Persistent XSS

• Insecure Direct Object Reference

• Failure to Restrict URLs

An attack technique that forces a user’s session credential or session ID to an explicit value.

• Brute Force Attack

• Session hijacking

• Session Fixation

• Dictionary attack

Which of the following is the best way to ensure that JavaScript cannot be used to access a cookie

• Set the Secure Flag in the Cookie

• Set the HTTP only Flag in the Cookie

• Use the CAPTCHA System

• Use non-persistent cookie

What threat arises from not flagging HTTP cookies with tokens as secure

• Session Hijacking

• Insecure Cryptographic Storage

• Access Control Violation

• Session replay

Which attack can execute scripts in the user’s browser and is capable of hijacking user sessions, defacing websites or redirecting the user to malicious sites

• SQL injection

• Cross-Site Scripting

• Malware Uploading

• Man In The Middle Attack

Why should you use CAPTCHA

• To create cryptographically random session IDs

• To protect credentials by using encryption or cryptographic salt and hash

• To protect authentication systems from automated or brute-force attacks

• To ensure that authentication systems implement inactivity timeout functionality

What flaw can lead to exposure of resources or functionality to unintended actors

• Session Fixation

• Improper Authentication

• Insecure Cryptographic Storage

• Invalidated Redirects and Forwards

Role-Based Access control helps prevent this OWASP Top 10 weakness

• Failure to restrict URL Access

• Invalidated Redirect or Forward

• Security Mis-configuration

• Insufficient Transport Layer Protection