CSRF attack

_____ is a type of attack that tricks site users or

administrators to unknowingly perform malicious actions for the attacker like changing order values and product prices, transfer funds from one account to another, change user passwords to hijack accounts.

• SQL Injection

• Cross-Site Scripting (XSS)

• Command Injection

• File Inclusion (LFI/RFI)

• Cross-Site Request Forgery (CSRF)

For every link or form which invoke state-changing functions with an unpredictable token for each user what attack can be prevented?

• OS Commanding

• Cross-site Scripting

• Cross-site Request Forgery

• Cross-site tracing

Which attack can execute scripts in the user’s browser and is capable of hijacking user sessions, defacing websites or redirecting the user to malicious sites

• SQL injection

• Cross Site Scripting

• Malware Uploading

• Man in the Middle

What happens when an application takes user inputted data and sends it to a web browser without proper validation and escaping?

• Security Mis-configuration

• Cross Site Scripting

• Insecure Direct Object Reference

• Broken Authentication and Session Management

Attack that exploits the trust that a site has in a user's browser

• Session Hijacking

• Cross-Site Request Forgery

• SQL injection

• Cross-Site Scripting

Which character is most likely to be used for an SQL injection attack

• Single quote (')

• Null (\0) byte

• Less than sign(<)

• Greater than sign(>)

Which of the following attacks occurs when a malicious user convinces a victim to send a request to a server with malicious input and the server echoes the input back to client?

• Reflected XSS

• Persistent XSS

• Insecure Direct Object Reference

• Failure to Restrict URLs

Which of the following is the best way to ensure that JavaScript cannot be used to access a cookie

• Set the Secure Flag in the Cookie

• Set the HTTP only Flag in the Cookie

• Use the CAPTCHA System

• Use non-persistent cookie

Which threat is most likely to occur when a POST parameter performs an operation on behalf of a user without checking a shared secret

• Cross Site Request Forgery

• Insecure Direct Object Reference

• Cross Site Scripting

• Injection

What threat arises from not flagging HTTP cookies with tokens as secure

• Session Hijacking

• Insecure Cryptographic Storage

• Access Control Violation

• Session replay