Application attacks

Question 1

This type of attack takes advantage of insecure user input on a webpage, and takes advantage of a victim by tricking them into clicking on a link which has malicious JavaScript in the URL.

Answer 1

XSS (reflected) (non persistent)

Cross site scripting.

Question 2

This type of attack takes advantage of unsanitized user input into a text field, allowing attackers to post a message to social media, or any other web page, containing a malicious payload. It is now stored on the websites database and anyone who loads this page will execute the malicious script.

Answer 2

Stored XSS attack

stored cross site scripting

Question 3

Which type of attack takes advantage of a user input form that allows attackers to add their own information into a data stream?

Answer 3

Injection attack.

Question 4

Which attack is able to overwrite other memory areas by filling up all of the available space in another?

Answer 4

Buffer overflow.

Question 5

Which attack takes advantage of being able to intercept a hash of a victim’s password in transit (usually by means of arp poisoning or a network tap) and then later forwarding a crafted authentication request using that captured hash to an authentication server?

Answer 5

Pass the hash

Question 6

Which attack is done by stealing a session id from a victim’s cookie and using it to authenticate?

Answer 6

Sidejacking (session hijacking)

Question 7

Which type of attack takes advantage of a web application’s trust already granted to a user and their broswer by making unauthorized requests on their behalf?

Answer 7

XSRF/CSRF - Cross site request forgery

Question 8

Which type of attack takes advantage of a vulnerability in a web application that allows them to send requests directly to a web server and have those requests completed by the web sever on behalf of the attacker, giving them access to the database and other backend functions using the web server as a middleman?

Answer 8

SSRF - server side request forgery

Question 9

What is a WAF?

Answer 9

Web application firewall.

Question 10

What does a WAF do?

Answer 10

A wirewall for web applications. Filters HTTP/S traffic going to and from the web server.

Question 11

What is it called when weak programming makes two events happen at the same time And causes an unexpected result? Doesn’t always have to be done with malicious intent.

Answer 11

Race conditions