Web Application Security & Testing Flashcards

What is SQL injection in web application security?

Answer: Inserting malicious SQL queries to manipulate the database.

SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database. By inserting malicious SQL code into input fields, an attacker can trick the database into executing unintended commands. This can lead to unauthorized access to sensitive data, modification of data, or even complete control over the database server.

What is Cross-Site Scripting (XSS)?

Answer: Injecting malicious scripts into web pages viewed by others.

Cross-Site Scripting (XSS) is a type of web security vulnerability that enables attackers to inject client-side scripts into web pages viewed by other users. When a victim loads the compromised page, their browser executes the malicious script, which can then steal session cookies, deface websites, or redirect users to malicious sites. XSS exploits the trust a user has in a particular website.

What is the purpose of web application firewalls (WAF)?

Answer: To monitor and filter HTTP traffic for security.

A Web Application Firewall (WAF) is a security solution specifically designed to protect web applications from various attacks by filtering and monitoring HTTP traffic. Unlike traditional network firewalls, WAFs understand the intricacies of web application protocols and can detect and block attacks like SQL injection, XSS, and CSRF. It acts as a reverse proxy, inspecting requests before they reach the web server.

How can session hijacking occur in web application security?

Answer: By intercepting and stealing session tokens.

Session hijacking occurs when an attacker successfully gains control of a user's authenticated session with a web application. This is typically achieved by intercepting or stealing the session token (e.g., a cookie) that identifies the user to the server. Once the attacker has the valid session token, they can impersonate the legitimate user without needing their login credentials.

What is the main goal of a web application penetration test?

Answer: To find and exploit vulnerabilities in the web application.

The main goal of a web application penetration test is to proactively identify and exploit security weaknesses within a web application's code, configuration, and underlying infrastructure. Testers simulate real-world attacks to uncover vulnerabilities such as SQL injection, XSS, broken authentication, and insecure direct object references. This helps organizations understand their security posture and remediate flaws before malicious actors can exploit them.

What is the purpose of input validation in preventing web application vulnerabilities?

Answer: To ensure that user inputs are properly sanitized.

Input validation is a critical security measure that checks and sanitizes all data entered by users into a web application. Its purpose is to prevent malicious data, such as SQL injection commands or XSS scripts, from being processed by the application. By ensuring inputs conform to expected formats and content, it significantly reduces the risk of various web application vulnerabilities.

What is the purpose of HTTP Secure (HTTPS) in web applications?

Answer: To encrypt data transmitted between client and server.

HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP, using SSL/TLS encryption to establish a secure connection between a web browser (client) and a web server. Its primary purpose is to encrypt all data exchanged, protecting it from eavesdropping, tampering, and forgery during transmission. This ensures the confidentiality and integrity of sensitive information like login credentials and financial data.

What is a common method used to test for SQL injection vulnerabilities in web applications?

Answer: Inserting SQL commands like single quote (') in input fields.

A common and basic method to test for SQL injection vulnerabilities is to insert special SQL characters, such as a single quote ('), into input fields. If the application is vulnerable, this character can break the intended SQL query, causing a database error or unexpected behavior. This indicates that user input is not being properly sanitized before being passed to the database.

What is Cross-Site Request Forgery (CSRF)?

Answer: Tricking users into making unintended actions on a web application.

Cross-Site Request Forgery (CSRF) is an attack that tricks a victim's web browser into sending an authenticated request to a vulnerable web application. The attacker crafts a malicious request (e.g., to change a password or transfer funds) and embeds it in a page the victim visits. If the victim is logged into the target application, their browser will automatically include their session cookies, making the request appear legitimate to the server.