Ethical Hacking Web Application Hacking Syllabus

What is a Content Security Policy (CSP) and how does it help against XSS?

CSP is an HTTP response header that whitelists trusted sources for scripts, styles, and other content. It restricts inline scripts and untrusted origins, mitigating the impact of injected scripts.

What is Cross-Site Request Forgery (CSRF)?

An attack that tricks an authenticated user's browser into sending an unwanted, state-changing request to a site where they are logged in, exploiting automatically sent credentials/cookies.

What are the main defenses against CSRF?

Anti-CSRF tokens (synchronizer tokens unique per session/request), SameSite cookie attribute, checking the Origin/Referer header, and requiring re-authentication for sensitive actions.

How does the SameSite cookie attribute mitigate CSRF, and what are its values?

It controls whether cookies are sent with cross-site requests. Values: Strict (never cross-site), Lax (only for top-level GET navigations), None (always, requires Secure). Strict/Lax block most CSRF.

What is the key difference between XSS and CSRF?

XSS exploits the user's TRUST in a site by running attacker script in the victim's browser. CSRF exploits the site's TRUST in the user's browser by forging authenticated requests. XSS can defeat CSRF tokens; CSRF cannot inject script.

What are File Inclusion vulnerabilities, and what are the two types?

Flaws where user input controls which file is included/executed by the application. Local File Inclusion (LFI): includes files already on the server. Remote File Inclusion (RFI): includes a file from a remote/attacker-controlled URL.

What is a common LFI technique to read arbitrary files, and how is it prevented?

Path traversal using ../ sequences (e.g., ../../etc/passwd). Prevented by whitelisting allowed files, sanitizing input, avoiding user input in file paths, and disabling remote inclusion (allow_url_include=Off in PHP).

What is a Directory/Path Traversal attack?

An attack that uses ../ or encoded variants to navigate outside the intended directory and access files elsewhere on the filesystem (e.g., configuration files, /etc/passwd).

What is the OWASP Top Ten?

A regularly updated awareness document listing the ten most critical web application security risks, published by the Open Worldwide Application Security Project (OWASP) to guide developers and testers.

What is the #1 category in the OWASP Top Ten 2021?

A01:2021 – Broken Access Control, which moved to the top spot because access control weaknesses are the most commonly found and impactful.

List the OWASP Top Ten 2021 categories in order.

A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable and Outdated Components, A07 Identification and Authentication Failures, A08 Software and Data Integrity Failures, A09 Security Logging and Monitoring Failures, A10 Server-Side Request Forgery (SSRF).

In OWASP 2021, what happened to the old 'Sensitive Data Exposure' and 'XSS' categories?

'Sensitive Data Exposure' was renamed A02 Cryptographic Failures (focusing on root cause). XSS was merged into A03 Injection.

What is Server-Side Request Forgery (SSRF)?

An attack where the server is tricked into making requests to unintended locations (e.g., internal services, cloud metadata endpoints) because it fetches a URL supplied or influenced by the attacker. It is A10 in OWASP 2021.

What is the difference between DAST and SAST scanners?

SAST (Static Application Security Testing) analyzes source code/binaries without running the app (white-box). DAST (Dynamic Application Security Testing) tests the running application from the outside (black-box), simulating attacks.

What is IAST and how does it differ from SAST and DAST?

Interactive Application Security Testing instruments the running application (via agents) to analyze code behavior during runtime/testing, combining strengths of SAST (code insight) and DAST (real execution) for more accurate results.

What is a false positive versus a false negative in vulnerability scanning?

False positive: the scanner reports a vulnerability that does not actually exist. False negative: a real vulnerability the scanner fails to detect. Automated scanners trade off between the two.

Name two widely used automated web application scanners.

Examples include OWASP ZAP (Zed Attack Proxy), Burp Suite Scanner, Nikto, Acunetix, and Nessus (for broader vulnerability scanning).

Why is manual penetration testing necessary despite automated scanners?

Automated scanners miss business-logic flaws, chained/multi-step vulnerabilities, complex authorization issues, and context-dependent bugs. Manual testing applies human reasoning to find what tools cannot.

What is an intercepting proxy and how is it used in manual web testing?

A tool (e.g., Burp Suite, OWASP ZAP) placed between the browser and server that lets the tester intercept, inspect, and modify HTTP/HTTPS requests and responses to probe for vulnerabilities.

What is 'fuzzing' in the context of manual/semi-automated web testing?

Sending large volumes of malformed, unexpected, or random inputs to an application to trigger errors, crashes, or unexpected behavior that reveal vulnerabilities.

What is the difference between black-box, white-box, and gray-box testing?

Black-box: tester has no internal knowledge (external attacker view). White-box: full knowledge including source code. Gray-box: partial knowledge (e.g., limited credentials/documentation).

What is input validation and what are the two main strategies?

Verifying that user input meets expected format/type/range before processing. Strategies: whitelisting (allow-list, accept only known-good input) and blacklisting (deny-list, reject known-bad). Whitelisting is preferred and more secure.

Why is client-side input validation insufficient on its own?

Client-side validation can be bypassed by an attacker who manipulates requests directly (e.g., via a proxy or crafted HTTP). Server-side validation is mandatory as the authoritative security control.

What is the difference between input validation, output encoding, and sanitization?

Input validation checks that input conforms to expectations (accept/reject). Sanitization cleans/modifies input to remove dangerous parts. Output encoding transforms data so it is rendered as inert text in a given context (e.g., HTML, JS, URL).

What is 'canonicalization' and why does it matter for input validation?

Canonicalization reduces input to its simplest, standard form before validation. It matters because attackers use alternate encodings (URL-encoding, Unicode, double-encoding) to bypass filters; validate only after canonicalizing.

Name three secure coding practices that reduce web vulnerabilities.

Use parameterized queries (prevent SQLi), apply context-aware output encoding (prevent XSS), enforce least privilege, validate all input server-side, avoid hardcoded secrets, and keep dependencies updated.

What is the principle of least privilege in secure coding?

Granting each user, process, or component only the minimum permissions necessary to perform its function, limiting the damage from a compromise or bug.

What is a Web Application Firewall (WAF)?

A security control that filters, monitors, and blocks malicious HTTP/HTTPS traffic to and from a web application, protecting against attacks like SQLi and XSS at the application layer (OSI Layer 7).

What is the difference between a WAF's positive (whitelist) and negative (blacklist) security model?

Positive model: allows only traffic matching known-good patterns, blocking everything else (stronger but harder to configure). Negative model: blocks traffic matching known-attack signatures, allowing the rest (easier but can miss novel attacks).

What is a limitation of relying solely on a WAF for web application security?

A WAF can be bypassed with obfuscation/encoding, does not fix underlying code flaws, may cause false positives blocking legitimate traffic, and struggles with business-logic attacks. It is a mitigating layer, not a substitute for secure code.

What OWASP project provides a widely used WAF rule set, and what layer of the OSI model do WAFs operate at?

The OWASP ModSecurity Core Rule Set (CRS) provides generic attack-detection rules. WAFs operate at Layer 7 (the Application layer) of the OSI model.