Update page 'OWASP test - Sloetjes'

OWASP test - Sloetjes.md

@@ -0,0 +1,64 @@
+==A01==
+
+* What is the principle of least privilege?
+> The principle of least privilege (PoLP) is a computer security concept in which a user is given the minimum levels of access necessary to perform his or her job functions. The objective is to prevent users from accessing data or commands that do not pertain to their role, thereby mitigating the potential damage caused by human errors or malicious actions.
+
+* Look up and describe the same-origin security policy, from the perspective of someone writing a web front-end.
+> The Same-Origin Policy (SOP) is a critical security concept in web development. It allows a web page's scripts to interact with resources from the same origin – that is, the combination of protocol (like http:// or https://), domain, and port must match. This helps to isolate websites from each other, protecting against potential security threats like Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS). As a web developer, you must always consider the SOP when making requests to different origins, and use techniques such as CORS (Cross-Origin Resource Sharing) when you want to allow controlled access across origins.
+
+* Describe some logic to monitor failed logins, and using geolocation of the incoming IP address, the permissions of the username trying to log in, and the number of previously failed logins, a procedure to determine whether to alert administrators to a genuine break-in attempt vs a brute-force attempt.
+> Monitor each login attempt, successful or not.
+    If a login attempt fails:
+        Record the IP address, timestamp, and username.
+        Increase the count of failed attempts for this IP address and/or username.
+    If there are more than a certain number of failed attempts in a certain timeframe from the same IP or username:
+        Use a geolocation service to identify the location of the IP.
+        Compare this location to the known or expected location of the user.
+        Check the user's permission level. Higher-risk users (like admins) may warrant tighter security measures.
+    If the location doesn't match or there are too many attempts, it may be a brute force or break-in attempt. Notify the administrators based on these factors.
+
+
+
+
+
+
+* Describe the lifetime of a session-only cookie, and how this could be used to create a session authorization token.
+* Describe the logic the web server should use when being presented with a session authorization token from a user, which isn't in the server's corresponding database.
+
+==A02==
+
+* Why is it important that session IDs be random, instead of sequentially assigned?  
+* Describe a way to attack a system which uses predictable session IDs.
+* What symmetric and non-symmetric ciphers does your browser use when connecting to the following web sites: www.google.com www.neverssl.com www.sayweee.com 
+* What is the currently recommended strength, in bits, for AES when used in a TLS server?
+* Describe what an export-grade cipher is.  Does this concept still apply in this day and age?  Why or why not?
+* Describe the circumstances under which any web browser released after 2020 would accept a SHA-1 signed TLS certificate, if any.
+* Is an extended validation TLS certificate more cryptographically secure than a normally issued TLS certificate?
+* What is Let's Encrypt, and what incident caused the project to be founded?
+* What is a rainbow table?
+* What is a cryptographic salt?
+* What is a cryptographic pepper?
+* Describe how to store and manage a cryptographic pepper in the context of multiple web servers sharing the same database, and backups.  You may assume the web servers and backups are managed by trusted personnel.
+* Name 3 password hash functions considered to be secure at the time you answer this question, and appropriate parameters for each when used to store user credentials in a secure database.
+* Describe the circumstances under which a properly managed credential storage system would allow a system administrator to recover the unencrypted/unhashed credentials with an offline copy of the credential store.
+* Can you trust a database administrator with private customer data, ever?
+* If the database administrator will be immediately executed by firing squad if private customer data ever leaks, then can you trust them with the private customer data?
+* If *you* will be immediately executed by firing squad if private customer data ever leaks, then can anyone ever trust *you* with the private customer data?
+* Can the *customer* ever be trusted with their own private customer data?
+* Can *anyone* ever be trusted with private customer data?
+
+==A03==
+
+* What is little bobby tables?
+* Describe the most insecure possible way to use an ORM to look up data in a table, using search parameters provided by the user.
+* What is log4shell?  What was the original intent of the exploited feature?  Describe the exploit.
+* Describe a technique to debug a SQL injection payload, if the statement's success or failure, and database output, cannot be seen by the attacker.
+* Describe how to prevent that technique.
+* Why is it important to have an administrative front-end to manage the production database, as opposed to using the SQL console directly?
+* How could you tell if a XPath query you found is vulnerable to an injection attack?
+* What is a HTML entity?
+* Describe an XSS vulnerability, and the most common way to defend against it.
+* Why is a left angle bracket (`<`) important in that context?
+* What is UTF-7?
+* Describe how to use UTF-7 to output a left angle bracket, without using a left angle bracket in your solution.
+* List three things to look for in an input sanitizer to avoid XSS problems.