Attack Mitigations

Question 1

SQL Injection

Answer 1

1) Use Prepared statements (with Parameterised queries
2) Use properly constructed stored procedures
3) Allow-list input validation
4) Escape all user submitted input

Question 2

Reflected XSS

Question 3

Stored XSS

Question 4

Directory Traversal Attack / Path Traversal Attack

Answer 4

1) Input Validation & Sanitisation
- White listing inputs
- Sanitising Input (remove/encode special characters)
2) Use secure APIs
3) Limit File Access
4) Configure Web Server
- Disable Directory Listing
- Block access to Sensitive files
5) Use a WAF (Web Application Firewall)

Question 5

Local File Inclusion Attack

Question 6

Remote File Inclusion Attack

Answer 6

1) Input validation & Sanitation
2) Disable remote URL file inclusion
3) Hardcoding file paths
4) Proper Error Handling to avoid leaking sensitive information to end-users
5) WAF to identify and block inclusion attempts
6)Use Security Headers to restrict the sources from which content can be loaded and to prevent browsers from interpreting files as different MIME types than what is declared.