C836 C.12 Flashcards

1
Q

Buffer overflows/overruns

A

A type of software development problem that occurs when we do not properly account for the size of the data input into our applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Race conditions

A

A type of software development vulnerability that occurs when multiple processes or multiple threads within a process control or share access to a particular resource, and the correct handling of that resource depends on the proper ordering or timing of transactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Input validation attack

A

A type of attack that can occur when we fail to validate the input to our applications or take steps to filter out unexpected or undesirable content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Authentication attack

A

A type of attack that can occur when we fail to use strong authentication mechanisms for our applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Authorization attack

A

A type of attack that can occur when we fail to use authorization best practices for our applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Cryptographic attack

A

A type of attack that can occur when we fail to properly design our security mechanisms when implementing cryptographic controls in our applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Client-side attack

A

A type of attack that takes advantage of weaknesses in the software loaded on client machines, or one that uses social engineering techniques to trick us into going along with the attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Cross-site scripting (XSS)

A

An attack carried out by placing code in the form of a scripting language into a web page, or other media, that is interpreted by a client browser

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Cross-site request forgery (XSRF)

A

In this type of attack, the attacker places a link on a web page in such a way that it will be automatically executed, in order to initiate a particular activity on another web page or application where the user is currently authenticated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Clickjacking

A

An attack that takes advantage of the graphical display capabilities of our browser to trick us into clicking on something we might not otherwise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Server-side attack

A

A type of attack on the web server that can target vulnerabilities such as lack of input validation, improper or inadequate permissions, or extraneous files left on the server from the development process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Name the four main categories of database security issues

A

Protocol issues, unauthenticated access, arbitrary code execution, and privilege escalation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Web application analysis tool

A

A type of tool that analyzes web pages or web-based applications and searches for common flaws such as XSS or SQL injection flaws, and improperly set permissions, extraneous files, outdated software versions, and many more such items

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A web server analysis tool that performs checks for many common server-side vulnerabilities, and creates an index of all the files and directories it can see on the target web server (a process known as spidering)

A

Nikto/Wikto

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Burp Suite

A

A well-known web analysis tool that offers a free and a professional version; the pro version includes advanced tools for conducting more in-depth attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Fuzzer

A

A type of tool that works by bombarding our applications with all manner of data and inputs from a wide variety of sources, in the hope that we can cause the application to fail or to perform in unexpected ways

17
Q

MiniFuzz File Fuzzer

A

A tool developed by Microsoft to find flaws in file-handling source code

18
Q

BinScope Binary Analyzer

A

A tool developed by Microsoft to examine source code for general good practices

19
Q

SDL Regex Fuzzer

A

A tool developed by Microsoft for testing certain pattern-matching expressions for potential vulnerabilities