NEW
Font size
WorksheetsWNS Revision
Total questions: 20
Worksheet time: 3mins
What does CVE stand for?
Common Viabilities and Exposures
Common Vulnerabilities and Exposures
Common Vulnerabilities and Exploits
Common Viabilities and Exploits
An attacker impersonates an employee from the IT department and asks a user for her password. He is attempting...
IP spoofing
man-in-the-middle attack
social engineering
LDAP injection
A spider is used to...
download copies of websites and their contents
intercept traffic between the browser and websites
steal session cookies from other logged-in users
automate XSS attacks against websites
Which is most likely to occur when the difference between code and data is not clear?
insecure direct object reference
security misconfiguration
broken authentication and session management
injection
The self-retweeting tweet attack shown is a type of...
stored XSS
reflected XSS
DOM-based XSS
IDOR
What is likely to happen when a server takes user inputted data and sends it to a browser without proper validation?
security misconfiguration
cross-site scripting
insecure direct object reference
broken authentication and session management
Which type of XSS attack executes in the browsers of every visitor of a page?
stored
reflected
DOM-based
man-in-the-middle
The Secure flag in a cookie ensures that...
the cookie is a persistent cookie
the cookie expires when the session ends
the cookie is sent over an encrypted channel
the cookie is not available to client script
This attack technique forces a user’s session credential or session ID to an explicit value.
brute force
dictionary attack
session fixation
session sidejacking
Zap and Burp Suite are examples of...
payloads
network sniffers
password crackers
proxies
The model representing the elements of a web page in a tree structure, created by the browser, is called...
Hypertext Markup Model
Document Object Model
Domain Oriented Model
Domain Object Model
GET, POST, PUT and DELETE are HTTP methods used in...
REST (Representational State Transfer)
FTP (File Transfer Protocol)
RPC (Remote Procedure Call)
SOAP (Simple Object Access Protocol)
A web proxy is used to intercept communication...
between the application and the database
between the browser and the web application
between the keyboard and the browser
between the application firewall and the application server
Fuzzing is a technique used to...
intercept traffic before it leaves the browser
intercept traffic after it leaves the browser
obscure the value of a string
automate brute-force attacks
Web intercepting proxies work at which layer of the OSI model?
data link
application
transport
network
Third-party cookies...
ask for consent, then breach the Same Origin Policy (SOP)
work around the Same Origin Policy (SOP)
breach the Same Origin Policy (SOP)
are never set by the third-party
The best approach to steal someone else's cookies is to...
sniff packets at network level using a tool like Wireshark
monitor requests and responses at application level using a tool like Zap
In this type of XSS attack, the malicious script never reaches the server.
reflected
DOM-based
stored
none of the above
Which is the best way to ensure that JavaScript cannot be used to access a cookie?
use a non-persistent cookie
use the CAPCHA system
set the HttpOnly flag
set the Secure flag
Stored XSS is considered more damaging than reflected XSS.
TRUE
FALSE
