Web Pentest

The most effective way of protecting against SQL injection is…

• blacklisting strings such as "1 OR 1=1" and "UNION" from input

• using an intrusion detection system to detect attacks

• white listing input (e.g. only allowing alphanumerical characters and spaces)

• use of prepared statements or parametrized queries

A cookie can not be used to control a users session/state

• False. Cookies are often used for tracking sessions

• True, only supercookies have this feature

What is IDOR?

• Insecure Door or Room

• Invalid Data or Reference

• Insecure Direct Object Reference

What is SQL injection?

• It is used to spoof or inject false headers in a HTTP request

• It is used in Buffer Overflow attacks to overwrite memory

• It is used to inject malicious code to a database server, through a query

What is the best practice in defending against SQL injection?

• Blocking specific ports that SQL injections are usually attacked via

• Programmers will not make web applications that allow user input

• Sanitizing users input in a web application

Netsparker and Burp Suite Professional are examples of:

• Web-focused vulnerability detection tools

• VPNs

• Web application firewalls

• Antimalware

Which of the following is not an example of an XSS attack?

• Stored XSS

• DOM-based XSS

• Reflected XSS

• DNS XSS

ssl handshake is used in http.

Above statement is true/false.

• Yes

• No

• Maybe

• I refuse to answer

Which is the first line in any HTTP request?

• Method and HTTP version

• Request body

• Hostname

• Content-Length

Which of the following is present in both a HTTP request line and a response status line?

• None of the mentioned

• HTTP version number

• URL

• Method