Application Attacks and Security Flashcards
An exploit connects to a specific TCP port and presents the attacker with an administrative command prompt. What type of attack is this?
Botnet
Trojan
Privilege escalation
Privilege escalation
Privilege escalation occurs when a user gains higher access rights than he or she should have, either because they were given too many rights or because of a security flaw
Which of the following best describes a buffer overflow attack?
Injecting database code via a web page
Using a dictionary file to crack passwords
Sending too much data to an application that allows an attacker to run arbitrary code
Sending too much data to an application that allows an attacker to run arbitrary code
A buffer overflow attack occurs when an attacker sends more data to an application or service than it is expecting. The extra data that is sent flows out of the area of memory (the buffer) assigned to the application, which can result in areas of code being overwritten and may cause the application to crash or allow arbitrary execution of commands on the target
You are analyzing web traffic in transit to your web server, and you notice someone logging on with a username of Bob with a password of “pass’ or 1=1–”. Which of the following describes what is happening?
XML injection
SQL injection
LDAP injection
SQL injection
A SQL injection attack occurs when the attacker inserts database (SQL) statements into a backend database, via a web site, that manipulates the way the database stores data. In this example, the attacker is trying to bypass the logon by using “pass’ or 1=1–” as a password, thus attempting to display all the database records
Which of the following is the most likely to mitigate against buffer overflow attacks?
Antivirus software
Firewall ACLs
Patching
Patching
Buffer overflow attacks can often be mitigated by ensuring that you keep up-to-date with system and application patches. As the vendor finds the vulnerabilities, that vendor will fix the issues through a patch. Input validation is also a common mitigation for buffer overflow attacks
What type of attack involves the attacker inserting a client-side script into the web page?
XSS
Watering hole
ARP poisoning
XSS
Cross-site scripting (XSS) is an attack that involves the attacker inserting script code into a web page so that it is then processed and executed by a client system when a user browses that web page
Your manager has read about SQL injection attacks and is wondering what can be done to best protect against them for applications that were developed in-house. What would you recommend?
Patching
Antivirus
Input validation
Input validation
A SQL injection attack involves the attacker inserting database code via a web application, where it is not expected. The best countermeasure to this is to have your programmers validate any information (check its accuracy) passed into an application
What type of file on your hard drive stores web app preferences and session data?
Cookie
Hosts
LMHOSTS
Cookie
A cookie is a text file used by a web browser to store web app preferences and session information. A secure cookie prevents attackers from using the cookie to impersonate a user through XSS attacks by scripting languages such as JavaScript (cookie HTTPOnly flag) and allows cookie transmission only over HTTPS (cookie Secure flag)
Which type of vulnerability results from writing data beyond expected memory boundaries?
Pointer dereference
Integer overflow
Buffer overflow
Buffer overflow
Buffer overflows result from writing data beyond expected memory boundaries, which can crash a program or allow arbitrary code execution
Which application-testing technique is the most likely to uncover improper input handling?
Fuzzing
Overloading
Penetration testing
Fuzzing
Fuzzing provides a large amount of input data, even invalid data, to an application in order to observe its behavior; the idea is to ensure that the application is stable and secure with its input and error handling
Which programming problem stems from multiple threads not executing in a predictable, sequential pattern?
Blue screen of death
Multi-core CPU throttling
Race condition
Race condition
In a race condition, when code is executed by multiple threads, the timing of dependent events is not predictable, and as a result, a different thread can function in an unintended manner. For example, a piece of code may check the value of a variable and take action later, while that variable’s value can change in the interim
A piece of malware replaces a library of code used as needed by a controlling program. What name describes this type of security issue?
DLL injection
Pointer dereference
Integer overflow
DLL injection
Dynamic-link library (DLL) injections insert code into a DLL, which is called by a program at runtime as needed
Which term describes applications that are allowed to run on company computers?
Application approved list
Application block list
Fuzzing
Application approved list
Allowed applications are applications that can run on the company’s computer systems. These apps are listed within a policy that applies to computers to control software execution to prevent potentially malicious software from running
Jane is the lead security officer for your company and is analyzing web server logs. Jane notices suspicious activity related to navigating the file system on a web server. What type of attack was most likely performed?
Integer overflow
Directory traversal/command injection
Malicious add-on
Directory traversal/command injection
Directory traversal, also known as command injection, occurs when the attacker accesses web server directories, which are restricted in order to execute commands found in the operating system of the web server
A malicious user deploys a rogue wireless access point that users unknowingly connect to. User traffic is captured, modified, and sent back out on the network in an attempt to send fraudulent user session data. Which type of attack it this?
Replay
Shimming
Refactoring
Replay
Replay attacks involve an attacker first capturing packets of interest, possibly manipulating something in the packet, and then sending it back out on the network. This type of attack can be used to gain access to sensitive resources as a valid user by resending authorized access traffic
An attacker tricks a user into clicking a malicious link that causes an unwanted action on a web site the user is currently authenticated to. What type of exploit is this?
Cross-site request forgery
Cross-site scripting
Replay
Cross-site request forgery
Cross-site request forgeries occur when an attacker tricks a user into executing unwanted actions on a web site she is currently authenticated to
