application defense Flashcards
a programming language designed to handle the occurrence of exceptions
error and exception handling
special conditions that change the normal flow of program executions
exceptions
the process of ensuring that a programs operates on clean, correct, and useful data is called
input validation
this mode makes it more difficult for malicious software to be installed on the computer
enable protected mode from internet explorer
it is used by internet explorer to control add-ons
ActiveX
text files, stored on a computer to save information about your preferences, browser settings, and web page preferences
cookies
cookies used by the site you are visiting
first party cookies
cookies placed by sites linked to the site you are visiting
third party cookies
software that allows users to share contents and access contents shared by other users
peer-to-peer (P2P)
this attack uses LDAP statements with arbitrary commands to exploit Web-based applications with access to a directory service.
LDAP injection
this attack injects and executes unwanted commands on the application
command injection
this attack includes database commands and those commands subsequently execute on the server.
SQL injection
this attacked forces a program to load a dynamic-link library (DLL).
DLL injection
this attack uses specific characters to traverse to the parent directory in a file system
Directory traversal
the process of including invalid data in an HTTP response header.
Header manipulation
this attack exploits computer application vulnerabilities before they are known and patched by the application’s developer
Zero-day
this attack exploits vulnerabilities in client applications that interact with a malicious server
Client-side
if run-time failures within if the code doesn’t produce memory leaks, garbled data, or invalid output; the application code is considered to be
exception-safe
a software testing technique that detects security problems by providing invalid, unexpected, or random data to the inputs of an application is called
fuzz testing
a systematic examination of an application’s source code is called
code review
a set of requirements to establish a standard configuration for all systems.
baselines
the process of testing an application under development
configuration testing
