Appendix H Flashcards
What can be found within HTML source code that may be beneficial to an attacker
Hidden Form Fields Database Connection Strings Credentials Developer Comments Other included files Authenticated only URLs
What Nmap script can be used to discover supported methods on a Web site
nmap –script=http-methods.nse ipaddress -n -p 80
What Metasploit plugin can be used to discover supported methods on a Web site
auxilary/scanner/http/options
What can be used to identify Verb tampering
Nmap script for verb tampering:
nmap –script=http-method-tamper.nse
msfplugin for verb tampering:
auxilary/scanner/http/verb_auth_bypass
How does Basic authentication send data
In plaintext
How does Digest authentication work
It sends a hash of the password
What is a common misconfiguration with the Apache .htaccess file
An application configured with basic security which limits to a specific HTTP request may be susceptible to Verb tampering. Meaning that by simply using a different request i.e. using GET instead of POST, it would be possible to access otherwise restricted forms.
What is the best practice of input validation
Web applications should perform input validation checking of all client provided variables, to strip dangerous characters used in many attacks (SQLi / XSS) such as ‘;–| and directives, HTML tags, and JavaScript strings.
What are the four strategies for validating data
Accept Known Good - “Whitelist” or “positive”
Checks that data is one of the known good values in list.
Any data that doesn’t match is rejected.
Accept Known Bad - “Blacklist” or “negative”
Blocks unexpected characters, strings or JavaScript which are known in list.
Requires an up to date list of negative characters.
Sanitise with Whitelist
Changes user input into an acceptable form.
Any character which aren’t part of approved list are removed, encoded or replaced.
Sanitise with Blacklist
Sanitises unexpected characters, strings or JavaScript which are known in list.
Requires an up to date list of negative characters.
What are the three types of XSS
Stored, Reflected, DOM
What is stored XSS
Injected code is stored permanently on the server and executed every time the page is visited
What is reflected XSS
When the XSS is not stored on the site, need to send the XSS parameters each time you visit the page.
What is DOM XSS
When the payload is executed as a result of modifying the DOM environment in the browser used by the original client side script.
What are the potential implications of SQLi
Recovery of data, command execution and compromising data
What would the following SQL injection do?
a’ UNION SELECT null,load_file(‘/etc/passwd’) #
Output the contents of /etc/passwd
