Topic 2: Web Vulnerabilities

Question 1

What are the 2 types of XSS attacks?

Answer 1

stored: code stored on target server
reflected: code added to URL, delivered to client, executed immediately

Question 2

how does Cross site scripting (xss) work?

Answer 2

attacker injects malicious scripts into webpage visited by victim, bypass origin policy

Question 3

how is info exfiltrated?

Answer 3

form redirection: script nonce/hashes ensure that only valid scripts run

Question 4

what are some xss defenses?

Answer 4

application-level firewalls, browser filters, input escaping, static code analysis

Question 5

where do vulnerabilities come from?

Answer 5

3rd party & software supply chain

Question 6

what is CSRF

Answer 6

attacker sends arbitrary http requests on behalf of victim

Question 7

what does CSRF stand for

Answer 7

cross-site request forgery

Question 8

how does CSRF work?

Answer 8

user authenticated with site A/logged on, malicious site B tricks user into submitting malicious site request to site A

Question 9

CSRF home router example

Answer 9

CSRF against router, now attacker can add names to DNS, disable wireless authentication, disable firewalls, set new passwords

Question 10

CSRF countermeasures

Answer 10

server-side: generate token as part of form and validates upon reception (use IDs, hashes)
client-side: cookie flag “samesite=strict” prevents the browser from attaching cookies to 3rd party requests

Question 11

biggest issue with websecurity?

Answer 11

handling of user input as input validation cannot be done on the client

Question 12

secure coding practices for SQL injection

Answer 12

• developers must never allow client-supplied data to modify SQL statements
• required SQL statements should be stored procedures in database server
• use prepared statements