Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Software security > OWASP part 1 > Flashcards

OWASP part 1 Flashcards

1
Q

What are 3 topics of OWASP?

A

Information gathering

Injection attacks

Session management attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does an attacker want to achieve with information gathering?

A

Find attack vectors (ways to enter a system or network)

Low hanging fruits

Improve efficiency of attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does a developer want to achieve with information gathering?

A

test scope
coverage
prioritization
test efficiency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What application information is gathered during the information gather fase (4)?

A

Application structure: All pages and subdomains you have found in the application.

Any external links.

Trust zones, what needs authentication/authorization and what is open.

Data flow within the application. What parameters and values are used. What GET and POST requests are sent, and what are the respones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What infrastructure/platform information is gathered during the information gather fase (5)?

A

Information about web server. Version that is running, the type.

Applications running on the server. If any of this have known vulnerabilities, known attack strategies can be exploited to gain access. We can also check if any of the applications are misconfigured.

Application entry points. Finding the applications attack surface. HTTP-requests, parameters.

Execution path through application. This means finding out about the structure and layout of the application.

Fingerprint Web Application Framework: Find out what frameworks an application implements. The well known frameworks will have known headers, cookies, and directory structures, making it easier to identify the application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Why is web debugging proxies useful?

A

They can capture and examine requests and responses.

They can be used to manipulate payloads.

Can be used in attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Name a Website copier tool used for information gathering

A

HTTtrack
VisualWget

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Name a Web debugging proxy server used for information gathering

A

Firefox developer tool

Fiddler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Name a Tool set used for information gathering

A

Kali linux

Burp suite

OWASP Zap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the main features of Owasp ZAP (6)?

A

Intercepting proxy

Active and passive scanners

Spider

Report generation

Brute force

Fuzzing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does the spider tool do in OWASP Zap?

A

To automatically descover new resources(URLs) on a particular site.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is Fiddler?

A

It is a web-debugging tool that monitors, inspects, edits, and logs all HTTPS traffic, issues requests between your computer and the Internet, and fiddles with incoming and outgoing data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When testing for vulnerabilities, should one always use only automated tools?

A

No, these tools are limited. Some information cannot be found using automated scanners.
Additional manual testing is always recommended.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Google dorking?

A

A technique that uses Google advanced search operations to find security holes in configs and computer code that websites are using.
The information found through dorking may not be readily available through standard search queries.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Name 3 injection attacks

A

SQLi
Blind SQLi
XPath injection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Name a possible SQLi query to delete a user table from a username input

A

username_input ’ OR 1=1); Drop TABLE Users; –

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What can an adversary achieve using SQLi (4)?

A

Bypass authentication

Privilege escalation

Stealing information

Modification/destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is blind SQLi?

A

Occurs when an application is vulnerable to SQLi, but its HTTP responses do not contain the result of the relevant SQL query or the details of any DB errors.

A type of SQLi attacks where the attacker asks the database true or false questions, and determines the answer based on the application response. For example can an attacker try to inject a query that returns ‘false’ and afterwards a query that return ‘true’. If the contents of the webpage change for these queries, the attacker is able to distinguish when the executed query return true or false.

When an attacker exploits SQL injection, sometimes the web application displays error messages from the database complaining that the SQL Query’s syntax is incorrect. Blind SQL injection is nearly identical to normal SQL Injection, the only difference being the way the data is retrieved from the database. When the database does not output data to the web page, an attacker is forced to steal data by asking the database a series of true or false questions. This makes exploiting the SQL Injection vulnerability more difficult, but not impossible. .

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is XPath injection?

A

Occurs when a website uses user input to construct an XPath query for XML data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Give an example of XPath injection

A

Normal:
string(//user[username/text()=’gandalf’ and
password/text()=’Abcd3’]/account/text())

Attack:
string(//user[username/text()=’’ or ‘1’ = ‘1’ and
password/text()=’’ or ‘1’ = ‘1’ ]/account/text())

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are 5 countermeasures agains SQLi?

A

Blacklisting
Whitelisting
Escaping
Prepared statement & bind variables
Mitigating impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is blacklisting when it comes to mitigating SQLi?

A

Filter away certain symbols such as quotes, semicolons, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Why is blacklisting a bad mitigation technique (2)?

A

It’s difficult to know exactly every symbol or combination of symbols that might be dangerous. This way, some dangerous symbols could be missed in the blacklist.

Blacklisting can also conflict with functional requirements of an application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is whitelisting?

A

Only allow certain, well-defined safe inputs.

25
Q

What can be used to define safe values in whitelisting, and what is a pitfall when using it?

A

RegExp

It is hard to define. RegExp that covers all safe values.

26
Q

What is escaping?

A

Escape characters instead of blacklisting:
‘ -> ‘’

Has the same pitfall as blacklisting, could always miss a dangerous character.

27
Q

What is the root cause of SQLis?

A

The input data gets interpreted as control

28
Q

What is the idea behind prepared statements and bind variables?

A

Decouple query statement and data input

29
Q

What is prepared statements?

A

Put placeholders in the queries where the input data is going to be.
Then we specify what data to be filled in for the placeholders.

30
Q

How is prepared statements used in Java?

A

PreparedStatement stmt=con.prepareStatement(“update emp set name=?
where id=?”);

stmt.setString(1,“Gandalf”); //1 specifies the first parameter in the query

stmt.setInt(2,101);
int i=stmt.executeUpdate();

31
Q

How can we mitigate impact of SQLis (5)?

A

Avoid information leakage by not displaying DB errors or stack traces to external users.

Only give users the privileges they need. For. example, only read access on the tables/views the user can query. Not allowing drop table privileges for a typical user.

Encrypt sensitive data

Key management precautions, don’t store decryption keys in the DB.

Hash passwords.

32
Q

How many SQLi test cases does OWASP define?

A

6

33
Q

What are the 6 SQLi test cases that OWASP defines?

A

Oracle Testing
MySQL Testing
SQL Server Testing
Testing PostgreSQL
MS Access Testing
Testing for NoSQL injection

34
Q

What are 6 other injection test cases from OWASP?

A

Testing for LDAP Injection
Testing for XML Injection
Testing for SSI Injection
Testing for XPath Injection
IMAP/SMTP Injection
Testing for Code Injection

35
Q

What is done during session management?

A

A user is authenticated once.
All subsequent requests are tied to the user

36
Q

Why is session management necessary?

A

Because HTTP is stateless, meaning each request-reponse pair is independent of other web interactions. It is impossible to know if two requests are from the same client.
Without session management, users would have to constantly re-authenticate

37
Q

What are session management attacks?

A

Attacks that has the goal of taking over the session of a user.

38
Q

What is a web session?

A

A sequence of network HTTP requests and response transactions associated with the same user.

39
Q

What are session tokens?

A

A unique string that identifies a specific session instance.

40
Q

How can session tokens be communicated?

A

Request-params: ?sessionToken=1234

Hidden form field:
<input></input>

Browser cookie: setcookie: sessionToken=1234

41
Q

What can the session management flow be when using cookies?

A

Browser: Sends user credentials

Server: Check credentials, if valid, index session with a cookie -> setcookie

Browser: Stores cookie

After this, the browser adds this cookie to subsequent requests, which are validated by the server on request-receipt.

42
Q

Name 3 session management attacks

A

Session token theft

Session token prediction

Session fixation attack

43
Q

How are cookies set by the server?

A

Server sets a cookie in the header of a HTTP response to the browser:

set-Cookie: token=1234; expire=Wed, 3-Aug-2022 08:00:00; path=/; domain=idi.ntnu.no

44
Q

How are cookies sent from the browser?

A

In header of a HTTP request, when visiting the domain of the same scope as the cookie.

Cookie: token=1234

45
Q

What is the cookie protocol problem?

A

Server only sees:
Cookie: NAME=VALUE

The server does not see which domain sends the cookie. This makes it vulnerable to session management attacks.

46
Q

What is session token theft - sniff network?

A

An attacker sniffs a network to steal information that is revealed when visiting unencrypted sites over HTTP.

Flow:
- A logs in to a site over HTTP
- The server send a logged-in session token to A
- A then visits a non-encrypted site over HTTP

  • The attacker waits for A to log in
  • Then steals the logged-in session token (in HTTP)
  • The attacker then impersonated A to issue a request
47
Q

What is network sniffing?

A

A technique used to monitor data packets that goes through a network.
Attackers use sniffers to capture data packets carrying sensitive information.

48
Q

What is the Logout problem, in regards to session token theft?

A

Unless a session token is deleted and invalidated (marked as expired), an attacker would be able to impersonate a user for a long time.

49
Q

What should happen when a user logs out?

A
  1. Delete session token from client
  2. Mark session token as expired on the server
50
Q

What are some solutions to session token theft?

A
  1. After user has logged in, all later communications must happen over an encrypted channel
  2. Remember to log out on all web servers
  3. Time-out session ID on all web servers
  4. Delete expired session ID on all web servers
  5. Bind session token to client IP or computer
51
Q

What are session cookies?

A

Temporary cookies stored in the browser’s memory until the browser window is closed

52
Q

What are persistent cookies?

A

Long-term cookies that are tagges by the issuer with an expiration-date.

Stored in the browser memory even after it has been closed.

Happens when clicking “Remember me”

53
Q

What is the session token prediction attack?

A

When a server uses predictable tokens, such as counters (user001, user002, user00X)

54
Q

What are non-predictable tokens?

A

If an attacker is seeing one or more tokens, they should not be able to predict other tokens.

55
Q

What are the solution to session token predictions attacks?

A

Use token generators from frameworks (ASP, Tomcat, Rails, Django), do not invent your own algorithm

56
Q

What are session fixation attacks?

A

This can occur when the server elevates the anonymous token to a logged-in token, without changing the value.

Steps:
- A visits a site using an anonymous token
- The attacker overwrites the anonymous token with the value of their own token
- The user logs in and gets the anonymous token with the attacker’s value elevated to logged-in token
- Attacker’s token is elevated to a logged-in token

57
Q

How can session tokens be overwritten?

A

Network tampering:
- A user visits a website over HTTP
- The server injects into the response to overwrite the secure cookie:
Set-cookie: SSID=maliciousToken

XSS

58
Q

How can session fixation be done?

A

Always issue a new session token, when elevating from anonymous token to logged-in token

59
Q

What are the 7 session management tests?

A

Testing for Bypassing Session Management Schema

Testing for Cookies attributes (WSTG-SESS-02)

Testing for Session Fixation (WSTG-SESS-03)

Testing for Exposed Session Variables

Testing for logout functionality (WSTG-SESS-06)

Test Session Timeout (WSTG-SESS-07)

Testing for Session puzzling (WSTG-SESS-08)

Software security (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions