Web Development Security 4 — Questions and Answers
Question 1: What is a timing attack in the context of web authentication?
- Exploiting measurable differences in response time to infer whether a guess (e.g., password or token) is partially correct (Correct answer)
- Attacking a server during peak traffic hours to maximize impact
- Sending requests with manipulated timestamp headers
- Forcing a session timeout by replaying old authentication tokens
Correct answer: Exploiting measurable differences in response time to infer whether a guess (e.g., password or token) is partially correct
Timing attacks measure response latency variations (e.g., early exit on string comparison) to deduce secret values one character at a time.
Question 2: Which of the following best describes a stored (persistent) XSS attack?
- Malicious script is saved in the server's database and served to all users who view the affected page (Correct answer)
- Malicious script is embedded in a URL and only affects users who click it
- Malicious script is injected via a DOM manipulation without touching the server
- Malicious script is delivered via a man-in-the-middle network injection
Correct answer: Malicious script is saved in the server's database and served to all users who view the affected page
Stored XSS persists in the database (e.g., a comment field) and executes in every victim's browser when they load the page containing the payload.
Question 3: What does HSTS (HTTP Strict Transport Security) accomplish?
- It instructs browsers to only connect to the site over HTTPS for a specified duration, preventing protocol downgrade attacks (Correct answer)
- It encrypts HTTP request headers end-to-end between client and server
- It forces servers to reject all HTTP connections at the TCP level
- It validates the site's TLS certificate against a pinned public key
Correct answer: It instructs browsers to only connect to the site over HTTPS for a specified duration, preventing protocol downgrade attacks
HSTS uses the Strict-Transport-Security response header to tell browsers to refuse HTTP connections to the domain for the max-age period.
Question 4: An API returns a list of orders and uses sequential numeric IDs in the URL (e.g., /api/orders/1001). What vulnerability does this expose?
- Insecure Direct Object Reference (IDOR), allowing users to access other users' orders by changing the ID (Correct answer)
- SQL Injection, since numeric IDs can be used in database queries
- Mass Assignment, since IDs map directly to database columns
- Path Traversal, since numeric paths can be used to navigate directories
Correct answer: Insecure Direct Object Reference (IDOR), allowing users to access other users' orders by changing the ID
IDOR occurs when predictable object references are not access-controlled, letting attackers enumerate and access unauthorized resources.
Question 5: Which hashing algorithm is currently recommended for securely storing passwords?
- bcrypt, scrypt, or Argon2 (Correct answer)
- SHA-256
- HMAC-SHA1
- MD5 with a salt
Correct answer: bcrypt, scrypt, or Argon2
bcrypt, scrypt, and Argon2 are adaptive, memory-hard algorithms designed to be slow and costly to brute-force, unlike general-purpose hashes.
Question 6: In the context of TLS, what is certificate pinning?
- Hardcoding expected certificate or public key values in the client to reject unexpected certificates even if CA-signed (Correct answer)
- Restricting a TLS certificate to a single IP address
- Preventing certificate renewal more than once per year
- Encrypting certificate metadata before transmitting it
Correct answer: Hardcoding expected certificate or public key values in the client to reject unexpected certificates even if CA-signed
Certificate pinning ensures the client only trusts a specific certificate or public key, protecting against rogue CA-issued certificates.
Question 7: What is the OWASP Top 10 primarily used for?
- Raising awareness of the most critical web application security risks (Correct answer)
- Providing a legal compliance checklist for web applications
- Listing the top 10 fastest web frameworks
- Ranking the most common programming languages by vulnerability count
Correct answer: Raising awareness of the most critical web application security risks
The OWASP Top 10 is an industry-standard awareness document cataloging the most critical and widespread web application security risks.
Web Development Security 4
What is a timing attack in the context of web authentication?