Certified Ethical Hacker (CEH) Web, Application, and Database Hacking Flashcards

24 sample cards from the Web, Application, and Database Hacking deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What is session hijacking in web applications?

   Stealing or predicting a valid session token/cookie to impersonate an authenticated user and take over their session without credentials.

2. What is a session fixation attack?

   The attacker sets or forces a known session ID on a victim before login; once the victim authenticates, the attacker reuses that fixed session ID to hijack the session.

3. What is privilege escalation, and what are its two types?

   Gaining higher access than authorized. Vertical escalation = gaining higher-privilege (e.g., admin) rights; horizontal escalation = accessing another user's resources at the same privilege level.

4. What is Cross-Site Scripting (XSS)?

   An injection flaw where an attacker injects malicious scripts into web pages viewed by other users, executing in their browsers to steal cookies, sessions, or perform actions.

5. Name and define the three types of XSS.

   Stored (persistent) – script saved on the server and served to users; Reflected – script reflected off the server in a response from a request; DOM-based – manipulation occurs entirely in the client-side DOM.

6. What is Cross-Site Request Forgery (CSRF)?

   An attack that tricks an authenticated user's browser into sending an unwanted request to a web app, performing actions on their behalf without consent; mitigated with anti-CSRF tokens.

7. What is OS command injection?

   An attacker injects operating-system commands into an application input that is passed to a system shell, allowing arbitrary command execution on the server.

8. Why is input validation important and which approach is preferred?

   It prevents malicious data from reaching interpreters. Whitelisting (allowlisting) valid input is preferred over blacklisting, since blacklists can be bypassed.

9. What is a web shell?

   A malicious script (e.g., PHP, ASP, JSP) uploaded to a web server that gives an attacker a remote command/control interface to execute commands and maintain persistence.

10. What is an insecure file upload vulnerability and a typical consequence?

    When an app allows uploading files without proper type/content checks, an attacker can upload a web shell or malicious script, leading to remote code execution.

11. What are two common security risks specific to APIs?

    Broken object level authorization (BOLA/IDOR), broken authentication, excessive data exposure, lack of rate limiting, and improper input validation (see OWASP API Security Top 10).

12. What is a webhook and what is a key security concern with it?

    A webhook is an automated HTTP callback that sends data to a URL when an event occurs. Key risk: unverified/forged requests, so payloads should be authenticated (e.g., signed with a shared secret/HMAC).

13. List three core web application countermeasures.

    Validate and sanitize all input, use parameterized queries/prepared statements, enforce least privilege, apply secure session management, deploy a WAF, and keep components patched.

14. What is a Web Application Firewall (WAF) and where does it operate?

    A WAF filters, monitors, and blocks malicious HTTP/HTTPS traffic to/from a web application, operating at Layer 7 (application layer) to defend against attacks like SQLi and XSS.

15. What is SQL injection (SQLi)?

    An attack that inserts/manipulates malicious SQL statements via application input so they are executed by the backend database, allowing unauthorized data access or modification.

16. Why does SQL injection occur (root cause)?

    Because user-supplied input is concatenated directly into SQL queries without proper validation, parameterization, or escaping, letting input alter query logic.

17. What does the classic injection ' OR '1'='1 achieve?

    It creates an always-true condition in a WHERE clause, bypassing authentication or returning all rows because the query condition is always satisfied.

18. What are the three main categories of SQL injection?

    In-band (e.g., error-based and UNION-based), Blind/Inferential (boolean-based and time-based), and Out-of-band SQL injection.

19. What is error-based SQL injection?

    An in-band technique that deliberately triggers database error messages, using the leaked error details to extract information about the database structure and data.

20. What is UNION-based SQL injection?

    An in-band technique using the UNION SQL operator to combine the result of an injected query with the original, retrieving data from other tables in the application's response.

21. What is the difference between boolean-based and time-based blind SQL injection?

    Boolean-based infers data from true/false differences in the app's response; time-based infers data by observing whether a conditional time delay (e.g., SLEEP/WAITFOR) occurs, with no visible data returned.

22. What is out-of-band SQL injection and when is it used?

    It exfiltrates data through a different channel (e.g., DNS or HTTP requests from the database to an attacker server). Used when in-band/blind methods are unreliable or responses are not returned directly.

23. Name two popular automated SQL injection tools.

    sqlmap and Havij (others include jSQL Injection and BSQL Hacker).

24. What are the primary countermeasures against SQL injection?

    Use parameterized queries/prepared statements, stored procedures, input validation (whitelisting), least-privilege database accounts, escaping inputs, and a WAF; avoid dynamic query string concatenation.

What this deck covers

Web, Application, and Database Hacking flashcards FAQ