Application Security Flashcards
What is a buffer overflow?
A vulnerability that occurs when a program writes more data into a buffer than it can hold, potentially overwriting adjacent memory.
What is a race condition in software security?
A flaw that occurs when multiple processes or threads access shared resources in an unintended sequence.
What is an input validation attack?
An attack that occurs when improperly validated user input is processed by an application, allowing unexpected behavior.
What are two common input validation attacks?
Format string attacks – Exploiting vulnerabilities in functions like printf() to leak memory or execute code.
SQL injection – Malicious input used to manipulate database queries.
What is an authentication attack?
An attempt to gain access to a system without proper credentials.
What is an authorization attack?
An attempt to gain access to unauthorized resources.
What is a cryptographic attack?
An attack that exploits weaknesses in encryption algorithms or implementations.
What are client-side attacks?
Attacks that exploit weaknesses in client-side software, such as web browsers or plugins.
What is Cross-Site Scripting (XSS)?
A client-side attack where malicious scripts are injected into a website, executed in the victim’s browser.
What are server-side attacks?
Attacks that exploit vulnerabilities in web servers, applications, or databases.
What are five common web server vulnerabilities?
Lack of input validation – Leads to SQL injection or XSS.
Weak permissions – Allows unauthorized access.
Extraneous files – Leaving debug files or backup data accessible.
Protocol issues – Misconfigurations in HTTP/HTTPS security settings.
Unauthenticated access – Publicly exposed admin panels.
What is a sniffer in application security?
A tool that monitors network traffic to detect potential security threats.
What are web application analysis tools, and why are they important?
Tools that scan for vulnerabilities in web applications before attackers exploit them.
What is a fuzzer, and how does it improve security?
A tool that bombards an application with unexpected inputs to find security flaws.
