OWASP Top 10

Hello..

still remember yesterday

What defines Web Application actually??  

Answer explanation

Application/software/system which resides in server and using web browser to display or perform certain function and it is deliver over WWW.

Three main components of Web Applications Architecture are _____, _____ and _____.

There are three layers of Web applications, namely, the presentation tier, logic tier and data tier. In which tier is responsible for handling the business workflow (e.g. verifying user credentials)?

• presentation tier

• logic tier

• data tier

• not sure tier

Which is the correct order of the FIRST THREE lists in the OWASP Top 10 Vulnerability?

• Broken Access Control, Cryptographic Failures and Injection.

• Injection, Cryptographic Failures and Broken Access Control.

• Broken Access Control, Insecure Design, and Security Misconfiguration.

• Injection, Insecure Design, and Security Misconfiguration.

Which web vulnerability occurs when an attacker is able to inject malicious code into a website's HTML or client-side scripts?

• Injection Flaws

• Cross-Site Scripting (XSS)

• Broken Authentication and Session Management

• Security Misconfiguration

Which web vulnerability involves an attacker manipulating the input data sent to a web application in order to execute unintended commands?

• Injection Flaws

• Cross-Site Scripting (XSS)

• Broken Authentication and Session Management

• Security Misconfiguration

Which web vulnerability occurs when an attacker is able to gain unauthorized access to sensitive data by bypassing the access controls in a web application?

• Injection Flaws

• Cross-Site Scripting (XSS)

• Broken Access Control

• Security Misconfiguration

Which web vulnerability enables the attacker to launch a denial-of-service attack on a third party by using your server as a proxy?

• Injection Flaws

• Broken Access Control

• Insufficient Logging and Monitoring

• Cross-Site Request Forgery (CSRF)

How can a web application developer prevent Server-Side Request Forgery (SSRF) attacks?

• Validate The URLs You Do Access

• Only Make Outgoing HTTP Calls On Behalf of Real Users

• Maintain a “blocklist” of domains you will never access in server-side requests

• All of the answers

What happens if Website authors did not secure sensitive communication done over WWW?

• Man-in-the-middle attacks

• Interception

• Leak of sensitive information

• All of the answers