Injection Flaws

Question 1

What is an SQL injection

Answer 1

• An attack that exploits the vulnerability of the invalidated user input
• can reveal data not meant to be seen

Question 2

How does an SQL injection work

Answer 2

• SELECT * FROM users WHERE name = “smith”
• smith ‘ OR ‘1’ = ‘1
• 1=1 is logically always true

Question 3

How to prevent an SQL injection

Answer 3

• input validation
• input sanitation
• query parameters
• prepared statements
• can be done at either web application layer or db layer

Question 4

What is XSS

Answer 4

• when data enters an application from an untrusted source
• data is not validated for malicious content
• can be used to steal cookies or hijack a session

Question 5

What is stored XSS

Answer 5

• permently stored in the website database
• doesnt need a user to click a link
• can happen when a user visits a website where the malicious code is stored in a blog comment or message forum

Question 6

What is reflected XSS?

Answer 6

• Where the victim typically follows a link
• malicious code is contained within the link
• malicious code runs on the client browser

Question 7

How to prevent XSS?

Answer 7

• subsitute HTML characters like < to <
• Whitelist acceptable characters
• escape all untrusted data
  *

Question 8

XSS Example

Answer 8

• simple test
• inserting
• script alert() scriptalert()
• sCript alert() sCript
• url or a blog comment