Cyber 3 Unit 3 Review Game

Which of the following approaches is an effective way of protecting yourself against SQL injection?

• Using parameterized statements in your code.

• Moving your database to a separate server.

• Frequently rotating your database passwords.

• Using HTTPS in your website.

If an attacker manages to store malicious JavaScript in your database, what could they do? Choose all that apply.

• Deface your website.

• Redirect other users to malicious sites.

• Hijack other users' sessions.

• Drop important tables in your database.

How can you prevent XSS attacks? Choose all that apply.

• Escape dynamic content when it is written out in HTML.

• Ask the user to disable JavaScript in their browser.

• Obfuscate your JavaScript.

• Whitelist permitted values for dynamic fields.

How could an attacker exploit a command execution vulnerability?

• Set up a fake website that looks like your site on a copycat domain.

• Summoning evil spirits and placing a curse on your database.

• Installing malicious code and making your server part of a botnet.

Which tag is typically used in a clickjacking attack to wrap another site?

• <script>

• <iframe>

• <center>

• <blink>

What is the purpose of anti-forgery tokens?

• Validating that a request is generated by a page that is connected to the same website.

• Validating a password.

• Validating a credit card number the user has entered.

Which of the following methods can circumvent directory traversal vulnerabilities? Choose all that apply.

• Keep static documents on a separate file system from your executable code.

• Making users change their password frequently.

• Storing documents in a content management system.

• Hiring private security guards to grimace at anyone approaching your servers.

Why is it a good idea to restrict what directories on disk your web server can access?

• It restricts the harm an attacker could do if they manage to find a way to access the disk through a server vulnerability.

• It saves on disk space.

• It forces your users to choose complex, less guessable passwords.

What kinds of pages are likely to contain reflected XSS vulnerabilities? Choose all that apply.

• Search pages

• Pages containing forms

• Static pages

• Error pages

If you use the html(...) function in JQuery, what should you be wary of?

• Untrusted input passed directly to the html(...) function may allow an attacker to inject malicious code in a page.

• The user's password may be 'html'.

• There is no html(...) function in JQuery.