Ch. 9 Flashcards
Indicators of a Web Attack
- Customers being unable to access services
- Suspicious activities in user accounts
- Leakage of sensitive data
- URLs redirecting to incorrect sites
- Web page defacements
- Unusually slow network performance
- Frequent rebooting of the server
- Anomalies in log files
- Error messages such as “internal server error”, “problem processing your request,” and “page not found”
Web Application Threats
- Cookie Poisoning
- SQL Injection
- Injection Flaws
- Cross-Site Request Forgery
- Directory Traversal
- Unvalidated Input
- Cross-Site Scripting (XSS)
- Sensitive Data Exposure
- Parameter/Form Tampering
- Denial of Service (DoS)
- Broken Access Control
- Security Misconfiguration
- Information Leakage
- Improper Error Handling
- Buffer Overflow
- Insufficient logging and monitoring
- Broken Authentication
- Log Tampering
What web application threat occurs when the application fails to guard memory properly and allows writing beyond maximum size?
Buffer overflow
What web application threat refers to the modification of a website’s remnant data for bypassing security measures or gaining unauthorized information?
Cookie poisoning
What web application threat occurs when information such as account records, credit card numbers, passwords, or other authenticated information generally stored by web applications either in a database or on a file system are exposed/
Sensitive data exposure
What web application threat refers to a drawback in a web application where it unintentionally reveals sensitive data to an unauthorized user?
Information leakage
What web application threat arises when a web application is unable to handle technical issues properly and the website returns information, such as database dumps, stack traces, and codes?
Improper error handling
What web application threat occurs when attackers exploit HTTP, gain access to unauthorized directories, and execute commands outside the web server’s root directory?
Directory traversal
What web application threat occurs when attackers insert commands via input data and are able to tamper with the data?
SQL injection
What web application threat occurs when attackers intend to manipulate the communication exchanged between the client and server to make changes in application data?
Parameter tampering
What web application threat is a method intended to terminate website or server operations by making resources unavailable to clients?
Denial-of-service
What web application threat occurs when attackers tamper with the URL, HTTP requests, headers, hidden fields, form fields, or query strings?
Unvalidated input
What web application threat occurs when attackers bypass the client’s ID security mechanisms, gain access privileges, and inject malicious scripts into specific fields in web pages?
Cross-site scripting
What web application threat occurs when attackers insert malicious code, commands, or scripts into the input gates of web applications, enabling the applications to interpret and run the newly supplied malicious input?
Injection flaws
What web application threat occurs when an authenticated user is forced to perform certain tasks on the web application chosen by an attacker?
Cross-site request forgery
What web application threat occurs when attackers identify a flaw, bypass authentication, and compromise the network?
Broken access control
What Microsoft-developed server architecture supports HTTP, HTTPS, FTP, FTPS, SMTP, and NNTP.
Internet Information Services
In what location are IIS log files stored by default?
%SystemDrive%\inetpub\logsLog files
What command is used to find if TCP and UPD ports have unusual listening?
netstat -na
The Apache web server follows a modular approach and consists of two major components: the Apache core and the _______________.
Apache modules
The elements of the Apache core that address the basic functionalities of the server as http_protocol, https_man, http_request, http_core, alloc, and ____________.
https_config
The Apache server generates two types of logs, one that records all the requests processed by the Apache web server and only that contain diagnostic information on errors that the server faced while processing requests. The two types of logs generated are _______________________,
access log and error log
What security software or hardware device is used to monitor, detect, and protect networks or systems from malicious activities; it alerts the concerned security personnel immediately upon detecting intrusions?
Intrusion Detection System (IDS)
How IDS Detects an Intrusion
- Signature Recognition
- Anomaly Detection
- Protocol Anomaly Detection
