Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Exams > WEB APP > Flashcards

WEB APP Flashcards

1
Q

What is the difference between a web server and a Dynamic type of server?

A

Web server just serves out static content, whereas dynamic content can reference a back end data store and server active content; most modern web applications are considered dynamic servers, running content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an application server?

A

A server referenced by the web/dynamic server that executes code; things like Websphere, JBOSS, Weblogic, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What was improved from HTTP 1.0 to 1.1?

A

caching support, extensions, bandiwth optimization, host header field

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is “push promise” ?

A

A feature of HTTP 2, it allows a web server to send content before the client has requested it. Like a predictive version of AJAX.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is http multiplexing?

A

A feature of HTTP 2, it allows a server to request multiple sockets at once to requests resources in parallel, rather than “pipelining” it all through the same connection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What moves HTTP to a text-based-on-the-wire type of connection to a binary form?

A

HTTP 2.0, which gives it better compression and reduces overhead/complexity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What string in an http request identifies the type of client software used to connect?

A

User-agent string. Describes the web client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Where is the web server technology identified in an HTTP request?

A

the “server” field

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Windows 7/2008 listed as in the user-agent string? Windows 8/2012?

A

NT 6.1 and NT 6.3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the difference between GET and POST?

A

Both request data from server, but GET uses the URL to pass parameters, POST uses the payload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Why is POST more secure than GET?

A

Parameters aren’t written to web server or proxy logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What echoes an HTTP request as seen by the server back to a client, for diagnostics?

A

TRACE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What HTTP request asks the server to return the list of request methods it supports? (which can then be used for interchange)

A

OPTIONS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Method used when accessing the an application through a proxy server.

A

CONNECT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How does a CONNECT request work?

A

The client connects to the proxy, and the CONNECT request tells the server where to go to connect to the resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What HTTP method is used for WebDAV attacks, and where are those type of systems usually found?

A

PUT, which lets you upload data to a resource that you specify. Found on intranet web servers, occasionally.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

“Switching Protocols” HTTP status code

A

101 (info)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

“redirect” HTTP status code

A

302

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

“Not modified” HTTP status code, and what is it for?

A

304; used to say that the content hasn’t changed, so the client can continue to use data that has been cached.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

“Unauthorized” to access http status code (use authentication to access this)

A

401

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Page not found HTTP status code

A

404

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Server error HTTP status code series

A

5xx

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Websockets were integrated with the __________ technology scheme

A

HTML5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

This protocol establishes a bi-directional comm pipe over a SINGLE tcp socket

A

websocket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How is a websocket established? How does it work?

A

A socket is established using JS/HTML5 code; a 101 (switching protocols) request is passed, and then requests are handled with the ws:// or wss:// protocol. Typically used with a .js file, but can be found insie an HTML page itself with

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is method interchange?

A

When you are able to use a GET in lieu of a POST, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

_______ authentication uses a base64 encoding when passed over the network, and uses a “real” to identify itself.

A

Basic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

How does basic authentication handle the actual process of authenticating?

A

The web server handles it. IIS uses local accounts, apache uses .htaccess

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are some problems with basic authentication? (Things an attacker will look for)

A
  1. No account lockout/max attempts
  2. Auth traffic passed in clear
  3. Can easily be replayed
  4. No log out functionality w/o closing browser
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is added to basic auth to to improve it in digest auth?

A

A nonce is added as a salt to the the md5 hashing off the password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Why is digest auth not much more secure than basic?

A

The nonce (used as a salt in the md5 hashing of the password) is passed in the clear, making it vulnerable to man in the middle attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Integrated windows auth is perfect for ______ types of attacks

A

XSS/CSRF; if you can take over a client browser, you can get access to the web server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Typically, the authentication in “forms based” auth is handled by

A

LDAP or a backend database; the user requests the form, fills out the form, and submits it; the application (not the underlying web server) processes the request and either sends an error or returns the resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Attack vectors (issues) for forms based auth

A
  1. Developer responsible for implementing proper security controls
  2. Possible to sniff/intercept tokens/cookies/sessions
  3. Possible to spoof the site (create a phishing attack)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Three parties for an Oauth transaction

A

User (@user)
Consumer (Tweetbot)
Service provider (Twitter)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Three items exchanged as part of an OAuth transaction

A
  1. Request token
  2. Secret
  3. Access token

The secret is used to sign the request, which then goes back to the service provider. An access token is generated and given back to the service provider, which is used to post the data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Hackers look for what in OAuth

A
  1. Want to find the secret key (due to insecure storage or interception)
  2. Highly dependent on consumer service to get the implementation right/regenerate key properly
  3. Possible to spoof the sight, steal the username/password
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Difference between OAuth 1.0 and 2.0

A
  1. SSL required for all 2.0 communications
  2. Signatures not required for API calls once token is generated in 2.0
  3. Tokens in 2.0 expire
  4. Less data generated in 2.0
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

SSL/TLS relies on _________ for encryption, which relies on trust with a ____________

A

PKI, certificate store

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

When a browser requests an HTTPS page, it receives ______________.

A

The servers public key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Heartbleed is a vulnerability in ________ and allows for the attacker to _____________.

A

SSL; read 64k chunks of memory and things resident there. (Username, passwords, server private key)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Nmap script to check heartbleed

A

ssl-heartbleed.nse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Five parts of the Sans reporting format

A 
Exec summary
Introduction
Methodology
Findings
Conclusions
(optional: Presentation)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Stages of the Sans Web app pen test methodology

A

Recon
Mapping
Discovery
Exploitation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is included with WHOIS record?

A 
Identifies owner
Authoritative name servers
Email addresses
Phone numbers
Names of tech POCs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What does DIG output that NSLOOKUP does not?

A

Specific types of DNS records (MX, AXFR (zone xfr) ANY)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is the fierce scanner for?

A

Designed to find hosts on a domain, using DNS queries. Will guess host names using a wordlist

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What does DNSrecon do?

A

Collects all of the standard records it can find from the domain, including SRV records (that can point to other attack vectors)

Reverse lookup for a range of IP addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

To omit a page or pages with specific strings from a google search

A

Use the “-“ key (site:www.sans.org -handlers)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

The google dorks (Google Hacking DB) is a repository of __________ and is found at _________.

A

Very specific searches, such as those finding webcams with default credentials and indexes/stock password pages.

It can be found at exploitdb

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Operators used in Shodan for finding things:

A

Finds devices based on city, country, lat/long, IP, hostname, operating system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is the “Google dorks” of Shodan? (The site where you can find legit uses of Shodan)

A 
SHINE (www.infracritical.com) 
Finds things like: 
Medical devices
Traffic lights 
Serial port servers
Data radios
Webcams/CCTVS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Tool that will search all the documents it can find on a site for METADATA (thinks like users, folders, printers, type of software, etc)

A

FOCA (Fingerprinting Orgs with Collected Archives)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Tool that gathers information about domains via PUBLIC information sources (IP addresses, emails, hosts, etc)

A

The Harvester

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

3 Tools that can be used to perform server foot printing

A

NMAP (with the -sV option)

Netcat: Connect to and grab the server string (i.e., connect and request a page, check response)

Netcraft toolbar

56
Q

Tool used (like Netcat) to perform SSL checks

A

OpenSSL (with it’s switches)

Ex: OpenSSL s_client -connect www.testurl.com

57
Q

.Net app that tests the strength of a web applications SSL ciphers

A

SSLDigger

58
Q

Free, publicly accessible site for testing the SSL configuration/strength of a publicly facing website. Gives you a nicely formatted output report

A

Qualys SSL Labs

59
Q

Easy test for heartbleed

A

the NMAP heartbleed script (–script=ssl-enum-ciphers heart.bleed -oN)

60
Q

Two types of virtual hosting

A

IP based: every host has a unique IP

Name based: every host shares an IP, and packets are addressed with the “host” field of the payload.

61
Q

Most common form of virtual hosting

A

Name based, which means all hosts share an IP but packets are multiplexed based on “host” field of packets

62
Q

Internet resource that can detect virtual hosting

A

Bing. use ip: to see all the host names that are returned on that IP

63
Q

How to identify load balancers in use

A 
URL analysis (sans.org vs. www2.sans.org)
timestamps of responses

examine the “last modified” date on the packet headers

cookies! Load balancers usually save a cookie on the browser machine that directs them to the same server they initially made the request on (look for “load” or “LB” or balancer in the cookie name)

Look for differences in HTTPS: different certificate names or cipher versoins

Look for differences in the comments/source code

64
Q

Best tool for checking the method interchange (seeing what methods a web server requests)

A

netcat; just try to request each type of function. Can be easily scripted.

65
Q

Browser extensions that give you insight into operating systems, web servers, packaged web applications, Languages, frameworks, and APIS for a site that you visit

A

Netcraft and Wappalyzer

66
Q

How to get wget to ignore the robots.txt file and download all of a site’s content recursively

A

Wget -r -l -3

-3 gives it a recursive depth of 3

67
Q

Once you have a site map and have conducted flow charting, the next step to analyzing a web site is:

A

Relationship Analysis: Shows how the components of a web application relate to each other. Place to look for authentication bypass or authorization bypass.

68
Q

Why is it important to analyze junctions between code written by two different developers?

A

Misunderstandings are common; one developer may assume that authentication/authorization is handled by a different part of the app, for example

Also, if you find a vulnerability in one part of the code, you can then move to see if the problem is systemic

69
Q

Cross-platform Java app that checks to see if pages exist based on a word list

A

OWASPs dirbuster

70
Q

4 Things used to maintain “session” for a browser

A

Cookies (USERID)
URL parameters
Hidden form fields
IP/Browser info

71
Q

Cookies that look like

  1. S2V2aW4gS9obnNvbg==
  2. 72b27b1b696ecaadfc0f212f16809850
  3. 655609cdf493495c9f166e6d
A
  1. Base64
  2. Md5sum
  3. Hex-encoded output from crypt
72
Q

3 ways to collect session information from a web site

A
  1. Manually (repeatedly request, check session tokens)
  2. Custom scripts
  3. Burp
73
Q

Difference between session data passed by GET and POST

A

Get passes it in the URL, Post passes it through hidden form elements in the payload

(They can also pass it in the cookie, or in a ViewState variable)

74
Q

How to determine what a specific type of framework/web app uses to store sessions

A

Google, idiot

75
Q

When developers create their own session IDs, they typically use the ____________ to create a token

A

The clients IP address

76
Q

Burp mode to analyze session tokens

A

Sequencer: we seed it URLs, and it tells you the method used to create the session token. Will tell you the randomness of the tokens when you give it other things to compare with.

77
Q

How to define a python variable (individual and array)

A 
Name = "blah and blah"
year = 1980

Relics = (“Holy grail, “Holy Hand grenade”, “Knights”)

78
Q

How to store a name/value pair in Python

A

“Name”: “Value”,
knights = (“Lancelot”:”The brave”)

Print( knights(“Lancelot”)

79
Q

How to comment in Python

A

Single line: #

Multi line:
“”
‘’’

80
Q

To define a python function, and then call it

A

Define: def

Call: fuctionname() with required inputs in the parents

81
Q

How to manipulate a file in Python

A

“Open”
“Read” loads the entire file into a string”
“Readlines” returns the entire file as a list
“Write” writes to the file
“Close”

82
Q

Part of Burp suite used to analyze the randomness of session tokens

A

Burp Sequencer. Checks the entropy, looks for predictability.

83
Q

Part of burp used to determine the specific way data is encrypted/compressed/encoded

A

Decoder

84
Q

Pitchfork fuzzing attack in burp is used if…

A

Each payload position needs to be fuzzed simultaneously

Useful if related injections are needed

85
Q

Battering ram fuzzing attack in Burp is used when…

A

One set of payloads will be injected into multiple positions

86
Q

Some places to look for errors in a forms page that will let you know if the user account being checked is valid

A 
HTTP Redirects (302)
Changes in the URL (=1 for existing accounts,=2 for nonexistent)
Differences in the size of the page returned (use burp comparer)
87
Q

Python script that iterates user accounts based on a word list and tries to dump them into a forms account

A

User_enum script

88
Q

Command injection example

A

Using a DNS entry form to insert Linux commands to the underlying operating system.

89
Q

HTTP://multiplicand/index.pho?page=http://127.0.0.1/id.txt is an example of….

A

RFI.

90
Q

“Incorrect syntax near’ “ is an error message from a ________ DB

A

MS SQL

91
Q

“You have an error in your SQL syntax” is an error message from ________ kinds of DBs

A

MySQL error

92
Q

To create some database object like a record, table, or stored-procedure use the ______ cmd

A

CREATE

93
Q

The __________ command adds conditions to a SQL query

A

WHERE

94
Q

the __________ command deletes data from a SQL DB

A

DROP (drop user_table;)

95
Q

All SQL commands end with

A

;

96
Q

Select a part of the string in a SQL command

A

SUBSTRING

97
Q

Standard SQL query looks like:

A

Select from ;

98
Q

How do we use Boolean statements to look for Blind SQL?

A

We can send an acceptable SQL statement that returns YES if a condition is met.

IE, return index.php?itemid=0’ and 1=1; –

99
Q

Python based framework to speed th exploitation of blind SQL injection flaws

A

Does binary and frequency searches: BBQSQL

100
Q

A JavaScript “switch” statement is used to

A

Choose between multiple conditions; the case runs until the break is encountered. (Iterates through different case statements until one is executed and a break happens)

101
Q

JavaScript variables are defined by

A

Loosely typing them. var x; or var x=”Sarah”;

102
Q

A JavaScript “even” is…

A

A thing that happens that calls a function. Such as “onload” or “onclick” being when the page loads or an item is clicked, respectively.

103
Q

What does the “Find_accounts” python script do

A

Lets you iterate through a word list of last names to see if they can find the /URL/~username pages.

104
Q

Things that a script can NOT change in the request and expect to get a response because of same original policy

A

Port, host name, protocol.

105
Q

Two application filtering methods used to screen XSS traffic

A

Whitelist and Blacklists

106
Q

THREE methods to bypass input filtering

A

Encoding (Unicode, hex, etc)

Using an IMG tag instead of SCRIPT tags

107
Q

Most common way to get a user to actuate reflected XSS

A

Phishing. (Send them a crafted link)

108
Q

Is DOM XSS considered reflected or persistent?

A

Reflected

109
Q

Most common type of system exploited with DOM-based XSS

A

Hybrid/Mashup/Analytic systems, where they need to use the URL or other information from another box

110
Q

What is an “admin” type of persistent XSS flaw?

A

When you find a stored XSS flaw that requires admin approval: way to attack admin users, g’tee higher privilege level of first look

111
Q

What actually executes a DOM based XSS attack?

A

The browser; the web page uses values from the URL (GETS)

Everything executed within the browser

112
Q

Tool used to test for both XSS and SQLi on the a page.

A

TamperData

113
Q

Python based script that is used to automate testing for reflected XSS. Attacks a specific URL. Can crawl the site to discover additional points or funnel through a proxy.

A

XSSSniper

114
Q

Python XSS discovery tool with a GUI front end that can attempt to find filtering and bypass it. Has “special techniques” to attack things like USer-agents, Referers, cookies, etc.

A

XSSer

115
Q

XSS tool that injects a specific string everywhere in the site to see if it will reflect back to the browser

A

XSScrapy

116
Q

Two best parts of Burp to check for reflected XSS content

A

Use the Battering Ram payload, to test at multiple positions with one string

Use “Grep payloads” to search through the application responses for that string

117
Q

Key to CSRF attacks being viable

A

When transactions on a page use predictable parameters.

118
Q

Four step process for finding CSRF in an application

A
  1. Review the app logic
  2. Find functions that have predictable parameters and are worth screwing with
  3. Create a page with a link that executes that transaction
  4. Get an attacker to click on the link once they’ve already logged into the app with the predictable parameters
119
Q

Python application that hosts CSRF for testing and lets you automate CSRF attacks

A

Monkey first

120
Q

The xmlhttp.open AJAX request establishes

A

The properties of the request; GET or POST, and the resource being retrieved.

It does NOT initiate the request

121
Q

Xmlhttp.send() does…

A

Actually creates the connection with the URL

122
Q

Xmlhttp.onreadystatechange does…

A

Sets which function should be called when the ready state changes. (I.e., when the ready state number increases, what function gets called)

123
Q

XML.readystate does what?

A

A number, 0-4, that provides information about the state of the of the request. Can set different function (actions) for each ready state.

0-initialized
1-request has been set up
2-request has been sent
3-waiting for a response
4-response complete/received
124
Q

XMLhttp.responseText does what?

A

Is the property that contains the contents of the response from the server

125
Q

What is a “mash up” Web 2.0 server

A

A web server that integrates application widgets from multiple other sites to create a “mash-up” of connectivity. May require a proxy capability to work around same-origin restrictions.

126
Q

What is a proxy mash up feature?

A

When one application retrieves code from multiple other sites, using xmlhttp requests, and then delivers it to the client

127
Q

Why mash up application proxy servers can be attacked

A

If we can change the URL parameters (from POST to GET) we can have it retrieve content from malicious sources, or browse to other internet locations

128
Q

Application for performing android mobile code testing?

A

Base-androidlabs app, developed by security compass

129
Q

API file attacks with AJAX is commonly exploited by…

A

Looking for function calls that are loaded by scripts but NOT used by the app and using them for malicious purposes. (For example, using an “add users” function despite not having access to the admin page)

130
Q

WHy is it a good idea to find third party API/libraries when mapping source content?

A

Can use these libraries, which are pre-built and add functionality to a site, to carry out attacks.

131
Q

Things to look for that may call attention in source code to third party APIs and libraries? (Such as query or Google web toolkit)

A

SRC attributes, XHR requests

132
Q

What is JSON?

A

Similar to XML, but strictly for JavaScript/JAVA. It’s an array of arrays, or a “flat DB” of objects that can be parsed by JS and used to pass large amounts of data

133
Q

Why is JSON often vulnerable to information disclosure?

A

Application developers don’t want to parse requests both at the server and at the client, so often huge data sets are send to the client app and then parsed to display only what the browser needs

134
Q

Book method for injecting JSON content

A

Prematurely complete an object, insert a JS string, and comment the rest of the code out with //

135
Q

Automated scanner that mainly acts as a passive proxy and collects data on a site as you walk it.

A

RatProxy

136
Q

free, open source Automated scanner that performs adaptive scanning, brute forcing, and handles multiple languages at once (php, ASPX, etc). Uses

A

Skipfish

Exams (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions