PBQ (ATTACKS and Mitigation)

Question 1

21.16.163.17 - - [12/Mar/2021:22:31:12 0500]
“GET /items.jsp?<SCRIPT>userspy</SCRIPT>.jsp HTTP/1.1” 200

Answer 1

Attack = XSS, Control = Input Validation and Sanitization

Question 2

87.12.31.57 - - [12/Dec/2020:08:22:27 0100]
“GET /items/items.asp?itemid=999% UNION%SELECT%user-name, password%FROM%USERS”…

Answer 2

Attack = SQL Injection, Control = Use prepared statements with variable binding

Question 3

74.236.12.4 - - [4/June/2020:03:26:27 0100]
“GET /customer_account?customer_number=132355”…
74.236.12.4 - - [4/June/2020:03:25:27 0100]
“GET /customer_account?customer_number=254784”…

Answer 3

Attack = Insecure Object Reference
Control = Utilize indirect references

Question 4

Which vulnerability had a wide footprint due to the OpenSSL implementation of the TLS layer?

Answer 4

HeartBleed is a security vulnerability discovered in OpenSSL cryptographic software library

Question 5

What controls can be put in place to mitigate SQL Injection Vulnerabilities?

Answer 5

Using prepared statements and variable binding