Web App Testing

Question 1

What are the 3 types of XSS attacks?

Answer 1

Stored, Reflected, Dom-Based

Question 2

Describe Stored XSS.

Answer 2

This is a type of web application vulnerability where an attacker injects malicious JavaScript code into a web application, and this code is stored on the server (in a database, file, or other persistent storage).

Question 3

Describe Reflected XSS.

Answer 3

This is a type of web application vulnerability where malicious JavaScript code is injected into a website via a user-supplied input (such as a URL, query parameter, or form input). This code is immediately reflected back by the server in the response, and is executed in the user’s browser when they visit the malicious URL.

Question 4

Describe Dom-Based XSS.

Answer 4

This is a type of Cross-Site Scripting (XSS) vulnerability where the attack is executed entirely on the client-side (in the user’s browser) rather than being reflected or stored on the server.

Question 5

What is SQL Injection?

Answer 5

This is a type of attack where an attacker exploits vulnerabilities in a web application’s input fields (such as forms, search bars, or URLs) to manipulate an SQL query.

Question 6

List the OWASP top 10.

Answer 6

1. Broken Access Control
2. Cryptographic Failures
3. Injection
4. Insecure Design
5. Security Misconfiguration
6. Vulnerable and Outdated Components
7. Identification and Authentication Failures
8. Software and Data Integrity Failures
9. Security Logging and Monitoring Failures
10. Server-Side Request Forgery (SSRF)

Question 7

List 5 types of SQL Injection.

Answer 7

1. In-Band SQL Injection (Error-Based, Union-Based)
2. Blind SQL Injection (Boolean-Based, Time-Based)
3. Out-of-Band SQL Injection
4. Second-Order SQL Injection
5. Tautology-Based SQL Injection

Question 8

What are four types of server side vulnerabilities?

Answer 8

1. Server-Side Request Forgery (SSRF)
2. Server-Side Template Injection (SSTI)
3. Server-Side Includes Injection (SSI)
4. eXtensible Stylesheet Language Transformations (XLST) Server-Side Injection

Question 9

Describe Server-Side Request Forgery (SSRF)

Answer 9

This is a vulnerability where an attacker can manipulate a web app into sending unauthorized requests from the web server.

Question 10

Describe Server-Side Template Injection (SSTI)

Answer 10

This vulnerability occurs when user input is unsafely embedded in server-side templates, allowing attackers to inject and execute template code on the server.

Question 11

Describe Server-Side Includes Injection (SSI)

Answer 11

This vulnerability occurs when user input is unsafely included in SSI directives, allowing attackers to inject and execute server-side commands or scripts.

Question 12

Describe eXtensible Stylesheet Language Transformations (XLST) Server-Side Injection

Answer 12

An XSLT vulnerability occurs when user input is unsafely incorporated into XSLT transformations, allowing attackers to inject and execute arbitrary XSLT code on the server.

Question 13

Describe a real world example of SSRF.

Answer 13

A web app allows users to provide a URL to fetch and display a profile picture. If the app does not properly validate the URL, an attacker may specify an internal address such as http://localhost.

Question 14

Describe a real world example of SSI.

Answer 14

SSI can be used to include content that is present in all HTML pages, such as headers or footers. When an attacker can inject commands into the SSI directives, Server-Side Includes (SSI) Injection can occur.

Question 15

What can exploitation of a SSRF vulnerability lead to?

Answer 15

accessing internal systems, bypassing firewalls, and retrieving sensitive information.

Question 16

Describe a real world example of SSTI.

Answer 16

One example is when a web application uses user input directly in a server-side template such as:
template = “Hello, “ + user_input
render(template).
If an attacker supplies {{7*7}} as input, and the template engine evaluates it, the output will be Hello, 49, demonstrating that arbitrary template code can be injected and executed.

Question 17

Describe SSI Directives

Answer 17

SSI directives are special commands embedded in web pages (usually within HTML comments like <!--#echo var="DATE_LOCAL" -->) that instruct the web server to perform actions such as including files, executing scripts, or displaying environment variables before sending the page to the user.

Question 18

Describe XLST Transformations

Answer 18

XSLT transformations are processes where XML data is converted into other formats (such as HTML, plain text, or different XML structures) using XSLT (Extensible Stylesheet Language Transformations) stylesheets that define how the data should be transformed and presented.