Chapters 1 and 2 Difficult Concepts

Question 1

XML Bomb

Answer 1

Consumes memory exponentially, acting like a DoS attack

Question 2

XXE (XML External Entity Attack)

Answer 2

attempts to read local resources like password hashes in the shadow file

Question 3

DOM XSS

Answer 3

document object model
exploits client’s web browser using client side scripts to modify the content and layout of the webpage, client’s device executes the attack

Question 4

NOP Slide

Answer 4

attackers fill the buffer with NOP No operation instructions. The return address slides down the NOP instructions until it reaches the attackers code

Question 5

CSRF

Answer 5

ross site request forgery. triggers actions on different websites without user consent

Question 6

SELinux Policy Types

Answer 6

targeted - only specific processes are confined to a domain while others are unconfined
strict policies - every subject and object operates under mac but its more complex to setup. most secure
MLS policy implements a more stringent security model based on the Bell-LaPadula model, which focuses on maintaining data confidentiality by controlling read and write access based on security levels.