Week 8 - Web Attacks

Question 1

What is a SQL injection attack?

Answer 1

When an attacker writes SQL code into a form that then gets executed by the server.

Question 2

How do you prevent a SQL injection attack?

Answer 2

Sanitise user input

Question 3

What is XSS?

Answer 3

Cross site scripting. When an attacker submits javascript code through a form which then leads to the server serving the malicious code to other users.

Question 4

How do you prevent XSS?

Answer 4

Sanitise user input

Question 5

What is path traversal?

Answer 5

When an attacker gains access to material they shouldn’t by typing in the path in the url.

Question 6

How do you prevent path traversal attacks?

Answer 6

Make a user account for the web server and only give it access to public files.

Question 7

What is CSRF?

Answer 7

Cross site request forgery. An innocent, trusted end user is tricked by the attacker into sending a request to a vulnerable web server.

Question 8

How do you prevent CSRF?

Answer 8

Check the value of the referer header.
Every time a form is served, add an additional parameter with a token and check that it is valid upon submission.