Software Security - SQL/XSS Attack

1. SQL injection exploits a bug in what interaction of a web application?

• Server to database

2. SQL injection often allows an attacker to do:

• Access information he shouldn't

3. If you had to summarize the key (most specific) programming failure with SQL injection, it would be:

 
• Trusting without verifying: Trusting user data without verifying it is a general problem, not specific to SQL injection and thus not its key issue (but worth partial credit)

4. What is escaping an example of:

• Sanitization is a transformation of text that removes potentially harmful elements, and escaping does this when content could contain HTML markup

5. Suppose a web application implements authentication by constructing an SQL query from HTML from data using PHP's prepared statements. What would happen if an attacker entered FRANK' OR 1=1; -- in the web form's user field

• The application will try to authenticate a user whose name is FRANK' OR 1=1; -- 

6. Suppose a browser submits a GET request to URL http://www.mybank.com/accountinfo on 20 February 2015. Which of the following cookies, if already stored at the browser, would be sent with the request?

• sessid=14FEB15; expires=Sat, 28-Feb-2015; path=/; domain=.mybank.com

This cookie has not timed out, has a path that is a prefix of the given path, and references the proper domain suffix
7. Which of the following are ways that session cookies could be stolen or forged

• Compromising the browser or server:
  Injected code could exfiltrate cookies used for all users/sites
• Stealing it from the password database: Cookies are used for authentication, but are not passwords, and so are not stored in the password DB.

 

8. Which of the following are ways to reduce the impact of a stolen cookies

• Giving each cookie a timeout: Timing out a cookie means it can only be misused for a limited period
• Associate the cookie with the client's IP address: Associating a cookie with the client's IP address can prevent users not at that address from using the cookie, but note that this technique has usability problems and is not perfect (due to spoofing)

9. The browser implements security for Javascript programs for what reason?

• Such programs may access browser-controlled resources, which include potentially sensitive data in HTML documents and cookies

10. XSS subverts what policy

• Same Origin Correct: XSS uploads a script from host A to site B, which serves the script and thus bestows in it the site's privileges, circumventing the same origin policy