Chap 9 - Exploiting Application Vulnerabilities Flashcards
Which one of the following approaches, when feasible, is the most effective way to defeat injection attacks?
A. Browser‐based input validation
B. Input whitelisting
C. Input blacklisting
D. Signature detection
Input whitelisting
Input whitelisting approaches define the specific input type or range that users may provide. When developers can write clear business rules defining allowable user input, whitelisting is definitely the most effective way to prevent injection attacks.
Where should WAFs be placed?
Web application firewalls must be placed in front of web servers
Joe is examining the logs for his web server and discovers that a user sent input to a web application that contained the string WAITFOR. What type of attack was the user likely attempting?
A. Timing‐based SQL injection
B. HTML injection
C. Cross‐site scripting
D. Content‐based SQL injection
Timing‐based SQL injection
The use of the SQL WAITFOR command is a signature characteristic of a timing‐based SQL injection attack.
Which one of the following function calls is closely associated with Linux command injection attacks?
A. system()
B. sudo()
C. mkdir()
D. root()
system()
The system() function executes a command string against the operating system from within an application and may be used in command injection attacks.
Tina is conducting a penetration test and is trying to gain access to a user account. Which of the following is a good source for obtaining user account credentials?
A. Social engineering
B. Default account lists
C. Password dumps from compromised sites
D. All of the above
All of the above
Penetration testers may use a wide variety of sources when seeking to gain access to individual user accounts. These may include conducting social engineering attacks against individual users, obtaining password dumps from previously compromised sites, obtaining default account lists, and conducting password cracking attacks.
What type of credential used in Kerberos is often referred to as the “golden ticket” because of its potential for widespread reuse?
A. Session ticket
B. Ticket‐granting ticket (TGT)
C. Service ticket
D. User ticket
Ticket‐granting ticket (TGT)
TGTs are incredibly valuable and can be created with extended life spans. When attackers succeed in acquiring TGTs, the TGTs are often called “golden tickets” because they allow complete access to the Kerberos‐connected systems, including creation of new tickets, account changes, and even falsification of accounts or services.
Wendy is a penetration tester who wishes to engage in a session hijacking attack. What information is crucial for Wendy to obtain to ensure that her attack will be successful?
A. Session ticket
B. Session cookie
C. Username
D. User password
Session cookie
Websites use HTTP cookies to maintain sessions over time. If Wendy is able to obtain a copy of the user’s session cookie, she can use that cookie to impersonate the user’s browser and hijack the authenticated session.
Sherry is concerned that a web application in her organization supports unvalidated redirects. Which one of the following approaches would minimize the risk of this attack?
A. Requiring HTTPS
B. Encrypting session cookies
C. Implementing multifactor authentication
D. Restricting redirects to her domain
Restricting redirects to her domain
Unvalidated redirects instruct a web application to direct users to an arbitrary site at the conclusion of their transaction. This approach is quite dangerous because it allows an attacker to send users to a malicious site through a legitimate site that they trust. Sherry should restrict redirects so that they only occur within her trusted domain(s).
Joe checks his web server logs and sees that someone sent the following query string to an application running on the server:
http://www.mycompany.com/servicestatus.php?serviceID=892&serviceID=892’ ; DROP TABLE Services;–
What type of attack was most likely attempted?
A. Cross‐site scripting
B. Session hijacking
C. Parameter pollution
D. Man‐in‐the‐middle
Explanation
This query string is indicative of a parameter pollution attack. In this case, it appears that the attacker was waging a SQL injection attack and tried to use parameter pollution to slip the attack past content filtering technology. The two instances of the serviceID parameter in the query string indicate a parameter pollution attempt.
Parameter pollution
This query string is indicative of a parameter pollution attack. In this case, it appears that the attacker was waging a SQL injection attack and tried to use parameter pollution to slip the attack past content filtering technology. The two instances of the serviceID parameter in the query string indicate a parameter pollution attempt.
Parameter pollution
Parameter pollution is a technique where attackers send a web application multiple values for the same input variable, potentially bypassing input validation and security controls.
For example, by appending additional instances of a parameter in a URL, an attacker may exploit a web platform’s mishandling of multiple parameters, enabling attacks such as SQL injection to evade content filters
Upon further inspection, Joe finds a series of thousands of requests to the same URL coming from a single IP address. Here are a few examples:
http://www.mycompany.com/servicestatus.php?serviceID=1
http://www.mycompany.com/servicestatus.php?serviceID=2
http://www.mycompany.com/servicestatus.php?serviceID=3
http://www.mycompany.com/servicestatus.php?serviceID=4
http://www.mycompany.com/servicestatus.php?serviceID=5
http://www.mycompany.com/servicestatus.php?serviceID=6
What type of vulnerability was the attacker likely trying to exploit?
A. Insecure direct object reference
B. File upload
C. Unvalidated redirect
D. Session hijacking
Insecure direct object reference
The series of thousands of requests incrementing a variable indicate that the attacker was most likely attempting to exploit an insecure direct object reference vulnerability.
Insecure direct object reference
Insecure Direct Object Reference (IDOR) occurs when an application allows direct access to objects based on user-supplied input without proper authorization checks. This vulnerability can let attackers manipulate identifiers (like document IDs) in requests to access unauthorized data
What type of attack depends on the fact that users are often logged into many websites simultaneously in the same browser?
A. SQL injection
B. Cross‐site scripting
C. Cross‐site request forgery (XSRF)
D. File inclusion
Cross‐site request forgery (XSRF)
XSRF attacks work by making the reasonable assumption that users are often logged into many different websites at the same time. Attackers then embed code in one website that sends a command to a second website.
What type of cross‐site scripting attack would not be visible to a security professional inspecting the HTML source code in a browser?
A. Reflected XSS
B. Stored XSS
C. Persistent XSS
D. DOM‐based XSS
DOM‐based XSS
DOM‐based XSS attacks hide the attack code within the Document Object Model. This code would not be visible to someone viewing the HTML source of the page. Other XSS attacks would leave visible traces in the browser.
Persistent (or Stored) XSS
A persistent (or stored) XSS attack involves injecting malicious scripts into a website’s stored data, such as a database, which are then served to users who access the compromised content.
These attacks are “persistent” because the injected code remains on the server even when the attacker is not actively exploiting it
