Lesson 2 - Passing Data to Subsystems

What is the main security problem with meta-characters, when a dynamic web applications pass data to a subsystem?

• The parser may switch context from normal text to control command.

• They may contain names, addresses, passwords, and some private information.

• They contain raw data, instead of encrypted data.

• The programmer is not able to handle them.

Any database server based on SQL will need to have quotes escaped in string constants.

• True

• False

The hyphens are not the main root of problem in SQL injection attack.

• True

• False

If a program run an external command using operating system, the risk of which attack is more probably increased?

• SQL injection

• Shell command injection

• Session Hijacking

• All the above answers

All the following methods are useful to reduce the risk of Shell Command Injection, except:

• Managing without the shell

• Avoiding user input in the command arguments

• Avoiding 'Finger' and 'Sendmail' commands

• Handling shell metacharacters

An attacker entered this input as email address when registering in a system. What attack he intend to perform?

• Shell command injection

• SQL injection

• Session hijacking

• Metacharacter injection

An attacker can modify queries that are sent to a database by playing with input to the web application. It describes ...

• Shell Command Injection

• SQL Injection

• Cross-site Scripting

• Session Hijacking

If we do not handle metacharacters, our SQL-based database application will be vulnerable to SQL injection attacks.

• True

• False

A good measure against SQL injection attack is to pass query parameters separately from the SQL statement itself.

• True

• False

Which statement is incorrect about blacklisting of metacharacters in Shell Command Injection?

• We handle only the characters we know are unsafe.

• It is not a good measure because we may easily miss some metacharacters.

• Escaping shell metacharacters is easy with blacklisting.

• Blacklist must contains all metacharacters of different shells, if we are not quite sure what kind of shell will be used.