NEW
Font size
WorksheetsSecure Coding
Total questions: 10
Worksheet time: 5mins
What is the attack technique used to exploit web sites by altering backend database queries through inputting manipulated queries?
LDAP Injection
XML Injection
SQL Injection
OS Command Injection
What happens when an application takes user-inputted data and sends it to a web browser without proper validation and escaping?
Security Misconfiguration
Cross Site Scripting (XSS)
Insure Direct Object References (IDOR)
Broken Authentication and Session Management
Which of the following strategies is appropriate for mitigating an unvalidated redirect vulnerability
Validating the given url against a list of acceptable urls
Limiting the number of redirect attempts by a user
Making use of an indirect lookup table in place of fully qualified urls
Making sure that session cookies are encrypted
What threat arises from not flagging HTTP cookies with tokens as secure?
Session Hijacking
Insecure Cryptographic Storage
Access Control Validation
Session Replay
Is it perfectly acceptable to come up with our own homegrown encryption scheme?
True
False
How do we tighten our security?
Use strong passwords
Log-off personal account when not in use
Use firewall
Do not skip update
All of the above
Session fixation can be mitigated by?
Reusing existing session upon successful login and successful logout where appropriate
Invalidate existing sessions and regenerating new ones upon successful login
Making sure that html attributes are encoded
Making use of physical one-time token generator
__ attack is a type of attack against an application that parses XML input.
Injection
HTML
XXE
XSS
__ attack is a type of attack that allows an adversary to make arbitrary outbound requests from a server.
SQL Injection
HTML Injection
SSRF
XSS
What value does having an HTTP cookie with an HTTPOnly flag provide?
It prevents the cookie from being manipulated in transit
It requires the cookie to be transmitted over HTTPS
It prevents the cookie from being accessed via client-side javascript
It prevents the cookie from being accessed via server-side javascript
