Web Application Security

Question 1

What were the OWASP top 6 from 2017?

Answer 1

Injection, Broken Authentication, Sensitive Data Exposure, XML External Entities, Broken Access Control, Security Misconfiguration

Question 2

What are some possible defenses to SQL injections?

Answer 2

Input Sanitization, Prepared Statements

Question 3

What types of XSS attacks are there?

Answer 3

Non-persistent / Reflected XSS, Persistent / Stored XSS, DOM-based XSS

Question 4

What are some difficulties with detecting DOM-based XSS?

Answer 4

• Malicious URL exists only at the victim’s side
• Malicious URL exists only at a certain point in time
• Malicious URL is created dynamically

Question 5

What are some defenses against XSS?

Answer 5

Input sanitization, CSP

Question 6

What are some defenses against XSRF?

Answer 6

XSRF Tokens, Limit Sessions, Multi-factor Auth, Check HTTP Referrer

Question 7

What are countermeasures against Clickjacking?

Answer 7

Old: X-Frame-Options, Modern: CSP: frame-ancestors