Web Application Security Testing Flashcards

Which HTTP security header specifically prevents a web page from being embedded in an iframe to mitigate clickjacking attacks?

Answer: X-Frame-Options

The `X-Frame-Options` header (or the `frame-ancestors` CSP directive) controls whether a browser should allow a page to be rendered inside a frame, directly preventing clickjacking.

During a pentest, you find that the `Set-Cookie` header is missing the `HttpOnly` flag. What attack does this enable?

Answer: Cookie theft via JavaScript (XSS)

Without the `HttpOnly` flag, cookies are accessible via JavaScript, meaning a successful XSS attack can steal session cookies and allow account takeover.

A web application uses OAuth 2.0 and does not validate the `state` parameter during the authorization callback. What attack is possible?

Answer: Cross-Site Request Forgery on OAuth Flow

The OAuth `state` parameter functions as a CSRF token; without validating it, an attacker can forge a callback request and link their malicious account to a victim's session.

A JWT token uses `alg: none` and is accepted by the server without signature verification. What is this vulnerability called?

Answer: Algorithm Confusion (None Algorithm)

The 'none' algorithm attack exploits servers that accept JWTs with no signature when `alg` is set to `none`, allowing attackers to forge arbitrary token claims without a valid signature.

An application server sends the header `Access-Control-Allow-Origin: *` with `Access-Control-Allow-Credentials: true`. Why is this a security risk?

Answer: It allows any origin to make credentialed cross-origin requests, exposing authenticated data

A wildcard origin combined with `Allow-Credentials: true` is an invalid but dangerously misconfigured CORS policy; browsers block this combination, but some frameworks mishandle it by reflecting the request origin, granting any attacker site access to credentialed responses.

Which tool is commonly used to perform automated web application vulnerability scanning during a CompTIA PenTest+ engagement?

Answer: Nikto

Nikto is an open-source web server scanner that checks for dangerous files, outdated server software, and common web vulnerabilities, making it a standard tool for web application assessments.

A tester discovers that a web application renders user input inside a Jinja2 template. Submitting `{{7*7}}` returns `49`. What vulnerability is present?

Answer: Server-Side Template Injection (SSTI)

When template expressions like `{{7*7}}` are evaluated server-side and the result is returned, it confirms Server-Side Template Injection (SSTI), which can often lead to remote code execution.