1. As a web application user, what puts you at most risk to fall victim to a cross-site request forgery (CSRF) attack?
a) Using an old browser
b) Using a web app that is not fully protected by SSL/TLS
c) Using the "keep me logged in" option offered by web apps
d) Using weak passwords
2. TRUE or FALSE? All web applications are vulnerable to CSRF attacks unless there's a specific protection mechanism in place.
3. TRUE or FALSE? An attacker could use a cross-site scripting (XSS) flaw on a banking site to steal login credentials while the victim appears to remain on the legitimate banking site.
4. If you want your web application to defend itself against cross-site scripting attacks that steal session IDs, which cookie attribute is best able to help you?
a) Secure
b) Path
c) Expires
d) HttpOnly
5. TRUE or FALSE? The best way to eliminate SQL injection vulnerabilities in code is to validate input data.
6. TRUE or FALSE? Using POST requests with hidden form fields provides a significant level of protection against attackers who want to tamper with requests.
7. What is one way developers can defend against forced browsing attacks?
a) Incorporate GUIDs into file names
b) Log all user activity
c) Validate input data
d) Use a sensible directory naming scheme
8. A race condition in a web application can lead to a security hole. Which software analysis technique is best suited to identify the existence of a race condition?
a) A manual penetration test
b) A dynamic (blackbox) automated scan
c) A static (whitebox) scan
d) Functional tests by QA team
9. Your web application allows users to download their account statements in PDF format. What is the most secure way to implement this functionality?
a) Store all PDFs in an obscure directory on the web server and provide a link to the correct PDF depending on the user.
b) Generate the PDF on the fly, write it to a temporary directory on the server, and redirect the browser to that location (via 302 response).
c) Generate the PDF on the fly, store it in memory on the server, and send the bytes of the PDF to the browser directly (via 200 response).
d) Store the PDFs in a database and retrieve the correct PDF by looking at the identifier/primary key provided in the HTTP request.
10. TRUE or FALSE? Most web applications provide only one method of authentication, namely username + password.
ANSWERS
1. Answer: c
With the "keep me logged in" option, a persistent cookie is set causing you to be in a permanently-authenticated state. A key factor in a successful CSRF attack is that the victim is authenticated to the target site.
2. Answer: FALSE
Read-only web apps (no actions can be taken by a user) are not subject to CSRF attacks.
3. Answer: TRUE
With XSS, a login form having an action attribute that points to the attacker's site could be created via JavaScript on the legitimate site.
4. Answer: d
The HttpOnly attribute of a cookie instructs web browsers that JavaScript is not allowed to access the cookie. This means that malicious JavaScript injected in an XSS attack can't access the cookie. (HttpOnly is widely supported by web browsers)
5. Answer: FALSE
Using parameterized queries with data binding is the best way. That said, input data validation should always be done.
6. Answer: FALSE
Many free tools are available that make it easy for anyone to edit HTTP requests prior to being sent to the server.
7. Answer: a
Using GUIDs (globally unique identifiers) makes it near impossible for a user to guess valid file names. A problem I've seen frequently when doing pen tests is that the application names static files such as PDF or Excel documents in a logical, consistent manner. For example, a file name might include the user's name or account number. This could make it easy for one user to guess the name of other files and access information intended for other users.
8. Answer: c
Static analysis theoretically has full insight into the whole codebase and should be able to spot a situation where multiple threads compete for the same resource. With dynamic/run-time testing, it can't be guaranteed the race condition will ever manifest itself. If you've ever tried to reproduce a deadlock problem in a piece of software, you know how very difficult it can be.
9. Answer: c
Because the PDF is never written to disk in option c, there is no chance an attacker can forcefully browse to it. Option d is not secure because a user could tamper with the identifier to access another user's document.
10. Answer: FALSE
Most web applications provide TWO methods of authentication. One is username + password. The other is some sort of Forgot Password mechanism, which is often created as an afterthought and less secure than it needs to be.
SCORING
Answers Correct AppSec Ninja Level* 9-10 Kage 7-8 Jounin 5-6 Chuunin 3-4 Genin 0-1-2 Academy student * Based on Naruto Rank
