CVA Web Application & API Security Flashcards

Which attack technique involves embedding malicious SQL code in input fields to manipulate database queries?

Answer: SQL Injection

SQL Injection involves inserting or 'injecting' malicious SQL statements into an entry field to manipulate the backend database.

During API security testing, what does 'excessive data exposure' mean in the context of OWASP API Security Top 10?

Answer: APIs returning more data than the client needs, relying on clients to filter sensitive fields

Excessive data exposure occurs when an API returns full data objects and relies on the client to filter sensitive information, rather than the API itself controlling output.

What type of vulnerability exists when a web application processes XML input that includes references to external entities?

Answer: XML External Entity (XXE) Injection

XXE injection exploits XML parsers that process external entity references, potentially allowing file disclosure, SSRF, or denial of service.

Which technique is used to assess whether a web application properly invalidates session tokens after logout?

Answer: Post-logout token replay

Post-logout token replay tests whether a captured session token remains valid after the user logs out, verifying proper session invalidation.

What is the significance of testing for HTTP security headers such as Content-Security-Policy during a web application assessment?

Answer: They instruct browsers on permitted content sources, reducing XSS and injection attack surfaces

Content-Security-Policy headers instruct browsers to only load resources from approved sources, significantly reducing the risk of XSS and data injection attacks.

During a web assessment, you identify that the application uses predictable tokens for password reset links. Which vulnerability category does this fall under?

Answer: Identification and Authentication Failures

Predictable password reset tokens represent an Identification and Authentication Failure, as they allow attackers to guess or enumerate tokens and hijack account recovery.