Ethical Hacking Web Application Hacking Syllabus

Web Application Hacking syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Web Application Hacking in Ethical Hacking, not a summary of it.

1. 1

   Web Application Concepts

   3 topics

   • Web Application Architecture
   • Common Web Technologies
   • Web Application Security Models
2. 2

   Common Web Application Vulnerabilities

   4 topics

   • SQL Injection
   • Cross-site Scripting (XSS)
   • Cross-site Request Forgery (CSRF)
   • File Inclusion Vulnerabilities
3. 3

   Web Application Security Testing

   3 topics

   • OWASP Top Ten
   • Automated Scanners
   • Manual Testing Techniques
4. 4

   Countermeasures

   3 topics

   • Input Validation
   • Secure Coding Practices
   • Web Application Firewalls

Web Application Hacking flashcards for Ethical Hacking

18 of 51 cards from the Web Application Hacking deck — real questions with worked answers.

1. What are the three logical tiers of a typical web application architecture?

   Presentation tier (client/browser UI), Application/logic tier (server-side business logic), and Data tier (database/storage). This is the classic three-tier model.

2. In web application architecture, what is the role of a reverse proxy?

   A reverse proxy sits in front of application servers, receiving client requests and forwarding them to backend servers. It provides load balancing, SSL termination, caching, and hides internal server details.

3. What is the difference between server-side rendering (SSR) and client-side rendering (CSR)?

   SSR generates the full HTML on the server and sends it to the browser; CSR sends a minimal HTML shell plus JavaScript that builds the page in the browser (e.g., SPAs). SSR helps SEO/initial load; CSR gives richer interactivity.

4. Which HTTP methods are considered 'safe' and which are 'idempotent'?

   Safe methods (no state change): GET, HEAD, OPTIONS. Idempotent methods (same effect if repeated): GET, HEAD, PUT, DELETE, OPTIONS. POST is neither safe nor idempotent.

5. What does the acronym REST stand for and what are its key constraints?

   Representational State Transfer. Key constraints: client-server separation, statelessness, cacheability, uniform interface, layered system, and (optional) code-on-demand.

6. What is the purpose of the HTTP status code categories 2xx, 3xx, 4xx, and 5xx?

   2xx = Success, 3xx = Redirection, 4xx = Client error (e.g., 401, 403, 404), 5xx = Server error (e.g., 500, 502, 503).

7. What are cookies, and what do the HttpOnly and Secure attributes do?

   Cookies are small pieces of state stored by the browser and sent with requests. HttpOnly blocks JavaScript from reading the cookie (mitigates XSS theft); Secure ensures the cookie is only sent over HTTPS.

8. What is the Same-Origin Policy (SOP) and how is an 'origin' defined?

   SOP restricts scripts on one origin from accessing data on another origin. An origin is defined by the tuple of scheme (protocol) + host (domain) + port; all three must match to be same-origin.

9. What is CORS and what problem does it solve?

   Cross-Origin Resource Sharing is a mechanism using HTTP headers (e.g., Access-Control-Allow-Origin) that lets a server relax the Same-Origin Policy to allow controlled cross-origin requests from browsers.

10. What is the difference between authentication and authorization?

    Authentication verifies WHO a user is (identity, e.g., login credentials). Authorization determines WHAT an authenticated user is allowed to do (permissions/access control).

11. What is the principle of 'defense in depth' in web security?

    Layering multiple independent security controls (input validation, WAF, least privilege, encryption, monitoring) so that if one control fails, others still protect the system.

12. What does the CIA triad stand for in the context of a web application security model?

    Confidentiality (data kept secret), Integrity (data not tampered with), and Availability (system accessible when needed).

13. What is a session token and why must it be unpredictable?

    A session token is a unique identifier issued after login to track an authenticated session. It must be long, random, and unpredictable so attackers cannot guess or brute-force valid sessions (session hijacking).

14. What is SQL Injection (SQLi)?

    An attack where malicious SQL is inserted into an input field so that it is executed by the database, allowing attackers to read, modify, or delete data or bypass authentication.

15. Give the classic SQL injection payload that turns a login WHERE clause always true.

    ' OR '1'='1 — injected into a query like SELECT * FROM users WHERE user='...' AND pass='...' makes the condition always true, bypassing authentication.

16. What is the difference between in-band, blind, and out-of-band SQL injection?

    In-band: results returned in the same channel (error-based, union-based). Blind: no direct output; inferred via boolean or time delays. Out-of-band: data exfiltrated via a separate channel (e.g., DNS/HTTP requests).

17. What is the single most effective defense against SQL injection?

    Parameterized queries (prepared statements) that separate SQL code from user-supplied data, so input is treated only as data and never as executable SQL.

18. What is Cross-Site Scripting (XSS)?

    An attack where an attacker injects malicious scripts into web pages viewed by other users, causing the victim's browser to execute the script (e.g., stealing cookies, session hijacking, defacement).

See more Web Application Hacking flashcards →

Planning Web Application Hacking for Ethical Hacking

Web Application Hacking (Ethical Hacking) FAQ