Application Security Flashcards
What is input validation and what are the different types?
It ensures date inputs are valid, and there are two types Syntactic validation and semantic validation
What is syntactic validation?
Makes sure the input types and the lengths are what you want in your code
What semantic validation?
Makes sure the input that we do is what the application is expecting
What are schemas?
defines the structure and the content stick to what you want
What is blacklisting?
it bans characters and its hard to maintain
What is whitelisting?
is an acceptable character list and can break something
Vulnerabilities of HTTP Headers
Can be used to upload files, leak information like internal hostnames and backend servers/applications
What is code signing?
It uses certificates to show code integrity, the software author and gives a digital signature
How to secure cookies?
Don’t include sensitive information, and use https. Also use secure flag which verifies the cookies integrity but this can be bypassed
What is static code analysis
It is automated scan, but the code is not actviely running or in running state. This is good for source code and early detection in the SDLC
What is dynamic code analysis?
It is automated scan while the code is running and analyzes code behavior and how it interacts with different devices
What is Manual code analysis?
Not automated and is a slow process of line by line analysis and it open to interpretation
What is fuzzing
It is a automated process by inputting random data, invalid data and unexpected data. To see how the software responds, what are the error messages, are there memory leaks, does it crash, or show buffer overflow.
