Comp Security- Week 7

Question 1

Typical properties of spoof sites:

Answer 1

Show logos from honest site
Suspicious urls
Ask for user input
html copied from honest site (f12)
short lived

Question 2

What makes a site trusted?

Answer 2

Certificate of authority that is recognized by the browser in the uae it’s CERT

Question 3

What is SQL injection? What do hackers use it for?

Answer 3

The process of adding SQL statements in user input
Used by hackers to:
Probe databases
Bypass authorization
Execute multiple sql statements
Call built in stored procedures

Question 4

When does sql injection occur?

Answer 4

When developers dynamically build sql statements by using user input which then lets hacker add their own commands via user input

Question 5

Why is drop more harmful than delete

Answer 5

drop; drops an entire table
delete; deletes a record

Question 6

what does ‘ or 1=1 – do

Answer 6

1=1 make statement true
– cause rest of line to be ignored

Question 7

How do attackers know?

Answer 7

Insider info
Trial and error

Question 8

How to prevent?

Answer 8

Data validation strategies and all methods must check data type, syntax, length