Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CSCI 4130 - Intro to Cybersecurity > Web Security - Basics, SOP, Sessions > Flashcards

Web Security - Basics, SOP, Sessions Flashcards

1
Q

Define

Uniform Resource Identifier (URI)

Web Security

A

Identifies a resource (string)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define

Scheme

Web Security

A

Protocol and framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Components of Uniform Resource Identifier (URI)

Web Security

A
  • Scheme
  • Authority
  • Path
  • Query
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define

Authority

Web Security

A

Qualifying name (typically DNS host server or IP address)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define

Path

Web Security

A

Pathname consisting of “/” separated strings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define

Query

Web Security

A

Application-specific information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define

Uniform Resource Locator (URL)

Web Security

A

The identifier that contains information on how to locate a existing/available resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define

Uniform Resource Name (URN)

Web Security

A

Identifies an entity regardless of availability/existence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define

Hypertext Markup Language (HTML)

Web Security

A

A language that uses tags and attributes to display a webpage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Define

Javascript

Web Security

A

Powerful script to manipulate client-side data and provides object support

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why is Javascript suitable for HTML?

A

Javascript is weakly and dynamically typed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define

HTML Frames

Web Security

A

The tag that allows for multiple separate views/pages associated with separate URLS on the same page

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Directly visiting a page will lead to which frame?

Web Security

A

Main frame

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does the parent frame do?

Web Security

A

Specify its own style and the placement of the child frame within itself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define

Hypertext Transfer Protocol (HTTP)

Web Security

A

An application-layer protocol to transfer information between web client and server (typically port 80)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does a client do during HTTP?

Web Security

A

Opens a connection and sends requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does a server do during HTTP?

Web Security

A

Accept client’s connection and sends replies as a response to the requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

HTTP Request Headers specify

Web Security

A
  • Method
  • Resource
  • Protocol version
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

HTTP Methods

Web Security

A
  • GET()
  • HEAD()
  • POST()
  • PUT()
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define

HTTP Method: GET()

Web Security

A

Reads data from the URL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define

HTTP Method: HEAD()

Web Security

A

Fetches information about the data resource from the HTTP header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define

HTTP Method: POST()

Web Security

A

Submits “data” and stores data as value in a variable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define

HTTP Method: PUT()

Web Security

A

Uploads data to a stored variable under a specific resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What specifies a resource?

Web Security

A

An absolute URI or relative path

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How does an absolute URI request a resource?

Web Security

A

Through proxy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How does a relative path request a resource?

Web Security

A

Through a server that owns the resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Define

HTTP Response

Web Security

A

The answer or data read by the server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Define

Web Servers

Web Security

A

Something that loops forever to receive HTTP requests and send HTTP responses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Outline a TCP connection

Web Security

A
  1. Client requests to connect with a server
  2. Server accepts connection
  3. Client sends HTTP Request
  4. Server reads and processes HTTP Request
  5. Server writes back HTTP Response
  6. Connection closed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Define

Common Gateway Interface (CGI)

Web Security

A

Protocol for web servers to execute programs and generate pages dynamically

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Define

HTML Forms

Web Security

A

Collects data using GET and POST methods

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Where is data collected from when an HTML form uses GET()?

Web Security

A

Query

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Where is data collected from if an HTML form uses POST()?

Web Security

A

Body

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How is data sent back in an HTML form?

Web Security

A

Name-value pair

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What happens if data from an HTML form is an empty string?

Web Security

A

Neither name nor value is present

35
Q

Define

Hypertext Processor (PHP)

Web Security

A

Executes the page on the server side

36
Q

Define

Clientside Javascript

Web Security

A

APIs that control web client in an object-oriented way

37
Q

Define

User Agent

Web Security

A

Client side that retrieves and displays web data

38
Q

Define

Document Object Model (DOM)

Web Security

A

Documentation that treats an HTML like a tree structure

39
Q

List the parts of a Document Object Model (DOM)

Web Security

A
  • Node
  • Browser Object Model (BOM)
40
Q

Define

Node in a DOM

Web Security

A

Part of the document

41
Q

Define

Browser Object Model (BOM) in a DOM

Web Security

A

The API to browser properties

42
Q

Javascript security is much like

Web Security

A

Sandbox

43
Q

What is part of Javascript security?

Web Security

A
  • No access to files/network resources or browser history
  • Windows must be bigger than 100x100 px
44
Q

Describe

Frame Isolation

Web Security

A

Each site is isolated from one another (exception: if it’s the same site)

45
Q

List the types of frame isolation relationships

Web Security

A

Frame-Frame and Frame-Principal

46
Q

Describe

Frame-Frame

Web Security

A
  • canScript(A, B) - can A execute scripts on B?
  • canNav(A, B) - can A change B’s origin?
47
Q

Describe

Frame-Principal

Web Security

A

readCookie(F, D) and writeCookie(F, D) - can frame F perform on domain D?

48
Q

Describe

Same Origin Policy (SOP)

Web Security

A

Isolation of different pages such that a frame in one origin has no access to the resources of a different origin

49
Q

What is an Origin determined by?

Web Security

A

Determined by string matching and URL of a loaded frame’s location

50
Q

What is the tuple for an origin?

Web Security

A

[Protocol, hostname, port]

51
Q

Define

XMLHTTPRequests (XHR)

Web Security

A

Allows Javascript to send HTTP Requests to a server and receive data responses from the same origin

52
Q

Define

HTTP Responses under SOP

Web Security

A

Can interact with other frames from different origins but can’t inspect contents on scripts and resources

53
Q

Ways to relax SOP

Web Security

A
  • Set sites from different origins to be from the same domain
  • Access-Control-Allow-Origin/Cross-Origin resource sharing
  • Cross-document messaging
54
Q

Define

HTTP Authentication

Web Security

A

Basic authentication to deny access until credentials are sent during verification procedures

55
Q

Where can Access Control Policy be placed?

Web Security

A

Directory or global configuration file

56
Q

How can a web application keep track of a state if HTTPs are stateless?

Web Security

A
  • HTTP Cookies
  • Server side sessions
  • Embedding information in returned pages (i.e. hidden vars, modified URLS)
57
Q

Define

Session

Web Security

A

Sequence of HTTP request and responses associated with a user

58
Q

Define

Basic Authentication

Web Security

A

Form to send creditionals to server-side and an authenticator is returned for validation (i.e. cookie)

59
Q

Define

HTTP Cookie

Web Security

A

Small data set from and set by site stored in web broser to maintain a state on client side

60
Q

Where can cookies from domain A send its requests to?

Web Security

A

To domain A

61
Q

What defines the scope of a cookie?

Web Security

A

Domain and path

62
Q

What if no domain is set for a cookie?

Web Security

A

Host-only cookie is set (handled by browser)

63
Q

What happens if a path is specified for a cookie?

Web Security

A

Cookies are used when requesting a page within the path

64
Q

What happens if no path is specified for a cookie?

Web Security

A

Cookies are used for the path of the requested resource

65
Q

What controls the lifetime of a cookie?

Web Security

A

Expires and Max-Age

66
Q

Define

Expires

Web Security

A

When the broswer will delete the cookie

67
Q

What happens if no expiration or max-age is set for a cookie?

Web Security

A

Cookie becomes a session cookie and will expire when the session is completed

68
Q

Define

Secure Cookie

Web Security

A

Tells the browser how to use the cookie in secure/encrypted connections

69
Q

Define

HTTP Only Cookie

Web Security

A

No exposure of the cookie is allowed besides HTTP requests

70
Q

How can a client access a cookie?

Web Security

A
  • Read in scope
  • Sets a new cookie
  • Deletes a cookie
71
Q

SOP: Cookies vs. DOMS

abc.com/x ____ receive cookies for abc.com/y

Web Security

A

Does not receive

72
Q

SOP: Cookies vs. DOM

abc.com/x ____ access the DOM of abc.com/y

A

Can access

73
Q

SOP: Cookies vs. DOM

Using Javascript, why can abc.com/x see the cookies of abc.com/y?

Web Security

A

They share the same domain (abc.com)

74
Q

Ways to indirectly bypass SOP

Web Security

A
  • A related domain attacker controls cookies on another domain
  • Meeting the fixed storage limit of the cookie jar
  • MITM attacks
75
Q

What can a.abc.com do to b.abc.com?

Web Security

A

Influence and control b.abc.com’s cookies

76
Q

Define

Session Fixation Attack

Web Security

A

Where a session ID is overwritten and the session is hijacked

77
Q

How does a session fixation attack happen?

Web Security

A

Attacker gets the ID => victim visits under wrong ID and authenticates => attacker impersonates as victim with the authentication information

78
Q

Defenses against Session Fixations

Web Security

A
  • Update session IDs periodically
  • Initalize cross-site scripting
79
Q

Define

Cross-Site Request Forgery (CSRF)

Web Security

A

Malicious Javascript/server code tricking users to perform acts on a different web application

80
Q

Defenses against Cross-Site Request Forgery (CSRF)

Web Security

A
  • Avoid using GET() when exporting functionality
  • Referer Validation
  • Secure Token Validation
81
Q

Describe

Referer Validation

Web Security

A

Header fields that indicates who initated the request

82
Q

Limitation to Referer Validation

Web Security

A
  • Not always available
  • May leak information
83
Q

If the Referer Validation is none, what are the types of defaults?

Web Security

A
  • Allow: less secure, more usable
  • Deny: more secure, less usable
84
Q

Define

Secure Token Validation

Web Security

A

A randomly generated invisible token on the server side for every user’s action

85
Q

When is a Secure Token obtained?

Web Security

A

If the user explicitly visited the right page

86
Q

What are the goals of web security?

Web Security

A

Protect CIA, privacy, availability, and computing resource

CSCI 4130 - Intro to Cybersecurity (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions