NEW
Font size
WorksheetsLesson 2 - Passing Data to Subsystems
Total questions: 10
Worksheet time: 20mins
What is the main security problem with meta-characters, when a dynamic web applications pass data to a subsystem?
The parser may switch context from normal text to control command.
They may contain names, addresses, passwords, and some private information.
They contain raw data, instead of encrypted data.
The programmer is not able to handle them.
Any database server based on SQL will need to have quotes escaped in string constants.
True
False
The hyphens are not the main root of problem in SQL injection attack.
True
False
If a program run an external command using operating system, the risk of which attack is more probably increased?
SQL injection
Shell command injection
Session Hijacking
All the above answers
All the following methods are useful to reduce the risk of Shell Command Injection, except:
Managing without the shell
Avoiding user input in the command arguments
Avoiding 'Finger' and 'Sendmail' commands
Handling shell metacharacters
An attacker entered this input as email address when registering in a system. What attack he intend to perform?
Shell command injection
SQL injection
Session hijacking
Metacharacter injection
An attacker can modify queries that are sent to a database by playing with input to the web application. It describes ...
Shell Command Injection
SQL Injection
Cross-site Scripting
Session Hijacking
If we do not handle metacharacters, our SQL-based database application will be vulnerable to SQL injection attacks.
True
False
A good measure against SQL injection attack is to pass query parameters separately from the SQL statement itself.
True
False
Which statement is incorrect about blacklisting of metacharacters in Shell Command Injection?
We handle only the characters we know are unsafe.
It is not a good measure because we may easily miss some metacharacters.
Escaping shell metacharacters is easy with blacklisting.
Blacklist must contains all metacharacters of different shells, if we are not quite sure what kind of shell will be used.
