From f8e075a68da8135a563f690e97ccb1a1201475a7 Mon Sep 17 00:00:00 2001 From: j Date: Thu, 25 May 2023 10:29:39 +0200 Subject: [PATCH] Update page 'OWASP test questions' --- OWASP test questions.md | 60 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 OWASP test questions.md diff --git a/OWASP test questions.md b/OWASP test questions.md new file mode 100644 index 0000000..9df478c --- /dev/null +++ b/OWASP test questions.md @@ -0,0 +1,60 @@ +==A01== + +https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html + +* What is the principle of least privilege? +* Look up and describe the same-origin security policy, from the perspective of someone writing a web front-end. +* Describe some logic to monitor failed logins, and using geolocation of the incoming IP address, the permissions of the username trying to log in, and the number of previously failed logins, a procedure to determine whether to alert administrators to a genuine break-in attempt vs a brute-force attempt. +* Describe the lifetime of a session-only cookie, and how this could be used to create a session authorization token. +* Describe the logic the web server should use when being presented with an authorization token which isn't in the session token database. + +==A02== + +https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html + +https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html + +https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html + +* Why is it important that session IDs be random, instead of sequentially assigned? +* Describe a way to attack a system which uses predictable session IDs. +* What symmetric and non-symmetric ciphers does your browser use when connecting to the following web sites: www.google.com www.neverssl.com www.sayweee.com +* What is the currently recommended strength, in bits, for AES when used in a TLS server? +* Describe what an export-grade cipher is. Does this concept still apply in this day and age? Why or why not? +* Describe the circumstances under which any web browser released after 2020 would accept a SHA-1 signed TLS certificate, if any. +* Is an extended validation TLS certificate more cryptographically secure than a normally issued TLS certificate? +* What is Let's Encrypt, and what incident caused the project to be founded? +* What is a cryptographic salt? +* What is a cryptographic pepper? +* Describe how to store and manage a cryptographic pepper in the context of multiple web servers sharing the same database, and backups. You may assume the web servers and backups are managed by trusted personnel. +* Name 3 password hash functions considered to be secure at the time you answer this question, and appropriate parameters for each when used to store user credentials in a secure database. +* Describe the circumstances under which a properly managed credential storage system would allow a system administrator to recover the unencrypted/unhashed credentials with an offline copy of the credential store. +* Can you trust a database administrator with private customer data, ever? +* If the database administrator will be immediately executed by firing squad if private customer data ever leaks, then can you trust them with the private customer data? +* If *you* will be immediately executed by firing squad if private customer data ever leaks, then can anyone ever trust *you* with the private customer data? +* Can the *customer* ever be trusted with their own private customer data? +* Can *anyone* ever be trusted with private customer data? + +==A03== + +https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html + +https://cwe.mitre.org/data/definitions/79.html + +* What is little bobby tables? +* Describe the most insecure possible way to use an ORM to look up data in a table, using search parameters provided by the user. +* What is log4shell? What was the original intent of the exploited feature? Describe the exploit. +* Describe a technique to debug a SQL injection payload, if the statement's success or failure, and database output, cannot be seen by the attacker. +* Describe how to prevent that technique. +* Why is it important to have an administrative front-end to manage the production database, as opposed to using the SQL console directly? +* How could you tell if a XPath query you found is vulnerable to an injection attack? +* What is a HTML entity? +* Describe an XSS vulnerability, and the most common way to defend against it. +* Why is a left angle bracket (`<`) important in that context? +* What is UTF-7? +* Describe how to use UTF-7 to output a left angle bracket, without using a left angle bracket in your solution. +* List three things to look for in an input sanitizer to avoid XSS problems. + + + +