1What is the primary definition of Session Hijacking?
A.Crashing a web server by sending too many requests
B.Phishing a user to obtain their login credentials via email
C.Unauthorized encrypted communication between two servers
D.The exploitation of a valid computer session to gain unauthorized access to information or services
Correct Answer: The exploitation of a valid computer session to gain unauthorized access to information or services
Explanation:
Session hijacking involves an attacker taking over an active session between a user and a server after the user has authenticated.
Incorrect! Try again.
2Which of the following is a key difference between Session Hijacking and IP Spoofing?
A.Session Hijacking only works on UDP; IP Spoofing works on TCP
B.There is no difference; they are synonymous
C.IP Spoofing takes over an active session; Hijacking initiates a new one
D.Session Hijacking takes over an ongoing authenticated session; IP Spoofing creates unauthorized packets with a false source IP
Correct Answer: Session Hijacking takes over an ongoing authenticated session; IP Spoofing creates unauthorized packets with a false source IP
Explanation:
Hijacking relies on an existing valid session state, whereas spoofing is simply masking the source address, often to initiate a connection or hide identity.
Incorrect! Try again.
3In the context of TCP Session Hijacking, what must an attacker successfully predict to inject packets?
A.The MAC address
B.The Sequence Number (SEQ)
C.The DNS server IP
D.The User ID
Correct Answer: The Sequence Number (SEQ)
Explanation:
To inject data into a TCP stream, the attacker must correctly predict the next sequence number expected by the target machine.
Incorrect! Try again.
4What is 'Session Fixation'?
A.An attack where the attacker fixes the server errors
B.A method of fixing a static IP address to a session
C.An attack where the attacker sets a user's session ID to one known to the attacker before the user logs in
D.A defense mechanism to keep sessions stable
Correct Answer: An attack where the attacker sets a user's session ID to one known to the attacker before the user logs in
Explanation:
In session fixation, the attacker forces the victim to use a specific session ID, allowing the attacker to hijack the session once the user authenticates.
Incorrect! Try again.
5Which attack vector is commonly used to steal Session IDs stored in cookies?
A.SQL Injection
B.Ping of Death
C.Cross-Site Scripting (XSS)
D.Buffer Overflow
Correct Answer: Cross-Site Scripting (XSS)
Explanation:
XSS allows attackers to execute malicious scripts in the victim's browser, which can access document.cookie and send the Session ID to the attacker.
Incorrect! Try again.
6Which of the following acts as a countermeasure against Session Hijacking by encrypting data in transit?
A.Using Telnet
B.Disabling cookies
C.Using simple HTTP
D.Using SSL/TLS (HTTPS)
Correct Answer: Using SSL/TLS (HTTPS)
Explanation:
HTTPS encrypts the communication channel, making it difficult for attackers to sniff session IDs or tokens from the network traffic.
Incorrect! Try again.
7What is the purpose of the 'HttpOnly' flag in a Set-Cookie header?
A.To allow the cookie to be shared across different domains
B.To ensure the cookie expires immediately
C.To ensure the cookie is only sent over HTTP, not HTTPS
D.To prevent client-side scripts (like JavaScript) from accessing the cookie
Correct Answer: To prevent client-side scripts (like JavaScript) from accessing the cookie
Explanation:
The HttpOnly flag mitigates the risk of XSS attacks stealing session cookies by blocking JavaScript access to them.
Incorrect! Try again.
8In a Man-in-the-Middle (MITM) attack used for session hijacking, what tool is often used to manipulate the ARP cache?
A.Traceroute
B.Nmap
C.ARP Spoofing/Poisoning
D.Ping
Correct Answer: ARP Spoofing/Poisoning
Explanation:
ARP Spoofing associates the attacker's MAC address with the legitimate IP address of the gateway or victim, redirecting traffic through the attacker.
Incorrect! Try again.
9Passive Session Hijacking involves:
A.Resetting the connection
B.Crashing the server
C.Injecting malicious packets into the stream
D.Monitoring and capturing traffic without altering it
Correct Answer: Monitoring and capturing traffic without altering it
Explanation:
Passive hijacking implies sniffing the network to gather information (like credentials or session IDs) without actively disrupting or modifying the stream.
Incorrect! Try again.
10A good defensive strategy regarding Session IDs after a successful login is to:
A.Keep the same Session ID used before login
B.Use the user's username as the Session ID
C.Make the Session ID static for 24 hours
D.Regenerate a new Session ID
Correct Answer: Regenerate a new Session ID
Explanation:
Regenerating the session ID upon authentication prevents session fixation attacks where the attacker knows the pre-login ID.
Incorrect! Try again.
11In the Client-Server relationship, which entity is responsible for initiating the request?
A.Database
B.Server
C.Client
D.Firewall
Correct Answer: Client
Explanation:
The client (e.g., a web browser) initiates the communication by sending a request to the server.
Incorrect! Try again.
12Which HTTP method is generally considered less secure for transmitting sensitive data because parameters are shown in the URL?
A.POST
B.GET
C.CONNECT
D.HEAD
Correct Answer: GET
Explanation:
GET requests append data to the URL query string, which remains in browser history and server logs, exposing sensitive data.
Incorrect! Try again.
13What is 'Directory Traversal' in the context of web server vulnerabilities?
A.Moving files from one folder to another
B.Indexing the website on a search engine
C.Accessing files outside the web root folder by manipulating input (e.g., ../)
D.Traversing the network topology
Correct Answer: Accessing files outside the web root folder by manipulating input (e.g., ../)
Explanation:
Directory traversal exploits insufficient security validation of user-supplied input file names, allowing characters like '../' to access restricted parent directories.
Incorrect! Try again.
14Which of the following is a common vulnerability where a web application fails to properly filter user input before sending it to a database?
A.Session Timeout
B.DNS Spoofing
C.Denial of Service
D.SQL Injection
Correct Answer: SQL Injection
Explanation:
SQL Injection occurs when untrusted user input is concatenated directly into database commands without validation or escaping.
Incorrect! Try again.
15Web Parameter Tampering involves:
A.Changing the physical server hardware
B.Modifying data within form fields, URLs, or cookies to manipulate application behavior
C.Deleting web server logs
D.Updating the web browser version
Correct Answer: Modifying data within form fields, URLs, or cookies to manipulate application behavior
Explanation:
Attackers tamper with parameters (like price or user ID) sent from the client to the server to bypass logic or privilege checks.
Incorrect! Try again.
16Which tool is commonly used for vulnerability scanning of web applications?
A.Photoshop
B.Microsoft Word
C.Windows Media Player
D.Nikto or OWASP ZAP
Correct Answer: Nikto or OWASP ZAP
Explanation:
Nikto and OWASP ZAP are widely used tools designed to scan web servers and applications for known vulnerabilities and misconfigurations.
Incorrect! Try again.
17Why are hidden form fields dangerous if not validated by the server?
A.Users can view source, modify the hidden values, and submit them
B.They cannot be seen by the browser
C.They make the HTML code messy
D.They slow down the website
Correct Answer: Users can view source, modify the hidden values, and submit them
Explanation:
Hidden fields are just HTML text. An attacker can save the page, edit the hidden value (e.g., setting a product price to zero), and submit the form.
Incorrect! Try again.
18What does SQL stand for?
A.Standard Query List
B.Simple Query Logic
C.Structured Question Language
D.Structured Query Language
Correct Answer: Structured Query Language
Explanation:
SQL stands for Structured Query Language, the standard language for managing relational databases.
Incorrect! Try again.
19The core root cause of SQL Injection vulnerabilities is:
A.Using a firewall
B.The database is too slow
C.The web server is running Linux
D.Trusting user input and mixing code with data
Correct Answer: Trusting user input and mixing code with data
Explanation:
SQLi happens when the interpreter cannot distinguish between the intended code (the query) and the data provided by the user.
Incorrect! Try again.
20In a SQL Injection attack, what is the significance of the single quote (') character?
A.It deletes the database
B.It is used to delimit strings; inserting it can break the query structure
C.It encrypts the password
D.It starts a comment
Correct Answer: It is used to delimit strings; inserting it can break the query structure
Explanation:
Attackers use the single quote to close a data field in the code and begin injecting their own SQL commands.
Incorrect! Try again.
21What does the injection OR 1=1 typically achieve in a login bypass attack?
A.It causes a syntax error
B.It creates a condition that is always true, bypassing the password check
C.It deletes the user account
D.It sets the password to 1
Correct Answer: It creates a condition that is always true, bypassing the password check
Explanation:
Since 1 always equals 1, the database evaluates the condition as true, often returning the first record in the table (usually the admin).
Incorrect! Try again.
22Which SQL comment symbol is often used to ignore the remainder of the original query in MySQL?
A.//
B.%%
C.# or --
D.<!-- -->
Correct Answer: # or --
Explanation:
In MySQL, # or -- (dash-dash-space) comments out the rest of the query, effectively neutralizing password checks or other logic.
Incorrect! Try again.
23What is 'Blind SQL Injection'?
A.An attack where the database is offline
B.An attack using invisible ink
C.An attack where the database does not return data/errors to the screen, so the attacker infers data based on server behavior
D.An attack where the attacker cannot see the screen
Correct Answer: An attack where the database does not return data/errors to the screen, so the attacker infers data based on server behavior
Explanation:
In Blind SQLi, the attacker sends True/False questions to the DB and observes the response (time delay or content change) to extract data byte-by-byte.
Incorrect! Try again.
24Which SQL command is most dangerous regarding data loss if injected successfully?
A.DROP TABLE
B.INSERT
C.UNION
D.SELECT
Correct Answer: DROP TABLE
Explanation:
DROP TABLE removes entire tables and their data from the database, causing significant data loss.
Incorrect! Try again.
25What is a UNION-based SQL injection?
A.Creating a labor union for DBAs
B.Injecting into the Union Bank website
C.Joining two databases physically
D.Using the UNION operator to combine the results of the original query with the results of an injected query
Correct Answer: Using the UNION operator to combine the results of the original query with the results of an injected query
Explanation:
UNION allows an attacker to append the results of their own malicious SELECT query to the results of the legitimate query, displaying data on the page.
Incorrect! Try again.
26What is the most effective defense against SQL Injection?
Parameterized queries ensure the database treats user input as data, not as executable code, strictly separating the two.
Incorrect! Try again.
27How does 'Error-based SQL Injection' help an attacker?
A.It crashes the server immediately
B.It creates a backup of the database
C.It fixes errors in the code
D.It provides details about the database structure via verbose error messages
Correct Answer: It provides details about the database structure via verbose error messages
Explanation:
Attackers intentionally cause errors; if the application displays raw DB errors, it reveals table names, column types, or logic structures.
Incorrect! Try again.
28Which technique allows an attacker to evade basic pattern-matching detection systems (IDS) during SQL injection?
A.Sending the query via email
B.Using a faster internet connection
C.Writing the query in capital letters
D.URL Encoding or Hex Encoding
Correct Answer: URL Encoding or Hex Encoding
Explanation:
Encoding malicious characters (like replacing ' with %27) can sometimes bypass simple signature-based filters that look for specific plain-text strings.
Incorrect! Try again.
29What is the 'Principle of Least Privilege' in the context of database security?
A.Ensuring the database application connects with an account that has only the minimum necessary permissions
B.Blocking all users from the database
C.Giving every user admin rights
D.Using the oldest version of SQL
Correct Answer: Ensuring the database application connects with an account that has only the minimum necessary permissions
Explanation:
If the web app connects as 'sa' or 'root', an injection can destroy the whole DB. Least privilege limits the damage an attacker can do.
Incorrect! Try again.
30What is the role of a Web Application Firewall (WAF) regarding SQL Injection?
A.It creates user backups
B.It fixes the code automatically
C.It inspects incoming HTTP traffic and blocks patterns that look like SQL injection attacks
D.It encrypts the database
Correct Answer: It inspects incoming HTTP traffic and blocks patterns that look like SQL injection attacks
Explanation:
A WAF sits in front of the web server and filters malicious traffic based on rulesets, acting as a shield against known attack patterns.
Incorrect! Try again.
31When testing for SQL injection, what is 'Fuzzing'?
A.Encrypting the connection
B.Downloading the database
C.Sending random, invalid, or unexpected data to inputs to see how the application reacts
D.Cleaning the screen
Correct Answer: Sending random, invalid, or unexpected data to inputs to see how the application reacts
Explanation:
Fuzzing involves automatic injection of unexpected data (like special characters) to find crash points or error messages indicating vulnerabilities.
Incorrect! Try again.
32Which of the following represents a 'Time-based' Blind SQL Injection?
A.DROP TABLE Users
B.WAITFOR DELAY '0:0:10'
C.UNION ALL SELECT
D.SELECT * FROM Users
Correct Answer: WAITFOR DELAY '0:0:10'
Explanation:
This command instructs the database to pause for 10 seconds. If the page takes 10 seconds to load, the attacker knows their injection was executed.
Incorrect! Try again.
33In a web application, what is Input Validation?
A.Validating that the keyboard is connected
B.Checking if the user is an admin
C.Ensuring input data meets expected criteria (type, length, format) before processing
D.Validating the server license
Correct Answer: Ensuring input data meets expected criteria (type, length, format) before processing
Explanation:
Input validation checks if the data is what the application expects (e.g., ensuring an 'age' field is only a number), reducing attack surface.
Incorrect! Try again.
34What is the danger of enabling 'xp_cmdshell' in MS SQL Server?
A.It allows the execution of Operating System commands via SQL
B.It slows down queries
C.It changes the language to Spanish
D.It prevents tables from being created
Correct Answer: It allows the execution of Operating System commands via SQL
Explanation:
xp_cmdshell allows SQL Server to spawn a command shell. If an attacker injects into this, they can take control of the OS, not just the DB.
Incorrect! Try again.
35Which character is often used to chain multiple SQL queries together in a single injection (Stacking Queries)?
A.Colon (:)
B.Period (.)
C.Comma (,)
D.Semicolon (;)
Correct Answer: Semicolon (;)
Explanation:
The semicolon terminates a SQL statement. In databases that support stacked queries, an attacker can end the first query and start a new malicious one using ';'.
Incorrect! Try again.
36What is Whitespace Manipulation in the context of evading SQLi detection?
A.Using a larger monitor
B.Deleting all spaces in the code
C.Replacing spaces with other whitespace characters (like tabs or newlines) to bypass filters
D.Adding spaces to make the website look better
Correct Answer: Replacing spaces with other whitespace characters (like tabs or newlines) to bypass filters
Explanation:
If a filter blocks 'SELECT ', an attacker might write 'SELECT[tab]' or 'SELECT/*/ ' to bypass the filter while keeping valid SQL syntax.
Incorrect! Try again.
37Which of the following is an example of an 'In-band' SQL Injection?
A.The data is retrieved using the same channel (e.g., displayed on the webpage)
B.The attack relies solely on time delays
C.The attacker uses a different channel to retrieve data
D.The attack is performed over the phone
Correct Answer: The data is retrieved using the same channel (e.g., displayed on the webpage)
Explanation:
In-band SQLi (like UNION-based or Error-based) returns the results directly in the application's response to the attacker.
Incorrect! Try again.
38What is a 'stored' SQL injection?
A.The malicious code is permanently stored in the database (e.g., in a forum post) and executes later
B.The injection is stored on a USB drive
C.The injection only happens once
D.The code is stored in the browser cache
Correct Answer: The malicious code is permanently stored in the database (e.g., in a forum post) and executes later
Explanation:
Stored SQLi involves placing malicious input into the DB (like a comment field). It executes whenever the application retrieves and processes that data.
Incorrect! Try again.
39To secure cookies against session hijacking, the 'Secure' flag should be set to:
A.Encrypt the cookie content with ROT13
B.Make the cookie invisible
C.Allow the cookie on HTTP only
D.Ensure cookies are sent only over encrypted (HTTPS) connections
Correct Answer: Ensure cookies are sent only over encrypted (HTTPS) connections
Explanation:
The Secure flag prevents the browser from sending the cookie over an unencrypted HTTP connection, protecting it from network sniffing.
Incorrect! Try again.
40Which of these is NOT a valid method to test for SQL Injection?
A.Physical inspection of the server hard drive
B.Inputting a single quote into a search box
C.Inputting 1=1 logic
D.Running a vulnerability scanner
Correct Answer: Physical inspection of the server hard drive
Explanation:
Physical inspection does not reveal software logic vulnerabilities like SQL injection.
Incorrect! Try again.
41In a client-server architecture, where should security validation be most rigorously applied?
A.Server-side
B.Neither
C.Client-side only (JavaScript)
D.On the router only
Correct Answer: Server-side
Explanation:
Client-side validation can be bypassed easily (e.g., disabling JS). The server must always validate data before processing it.
Incorrect! Try again.
42How can 'Stored Procedures' help prevent SQL Injection?
A.They delete all data periodically
B.They encrypt the hard drive
C.They encapsulate queries and can accept parameters, functioning similarly to parameterized queries
D.They make the database slower
Correct Answer: They encapsulate queries and can accept parameters, functioning similarly to parameterized queries
Explanation:
When used correctly with parameters, stored procedures define the SQL logic beforehand, preventing user input from altering the query structure.
Incorrect! Try again.
43What does an attacker typically look for in a URL to attempt SQL Injection?
A.CSS files
B.Images (.jpg)
C.Query strings with parameters (e.g., ?id=5)
D.Static HTML pages
Correct Answer: Query strings with parameters (e.g., ?id=5)
Explanation:
Parameters passed in the URL (GET requests) are common vectors for injection if those parameters are used directly in a DB query.
Incorrect! Try again.
44Which of the following best describes 'Session Timeout' as a defensive strategy?
A.Banning the user forever
B.Turning off the server at night
C.Slowing down the internet connection
D.Closing the session automatically after a period of inactivity
Correct Answer: Closing the session automatically after a period of inactivity
Explanation:
Session timeouts reduce the window of opportunity for an attacker to hijack a session if a user walks away without logging out.
Incorrect! Try again.
45What is the risk of having 'Verbose Error Messages' enabled on a live production server?
A.It fills up the hard drive
B.It uses too much bandwidth
C.It looks unprofessional
D.It aids attackers in understanding the technology stack and database structure (Information Leakage)
Correct Answer: It aids attackers in understanding the technology stack and database structure (Information Leakage)
Explanation:
Detailed errors give attackers a roadmap of the internal workings, table names, and syntax required to exploit the system.
Incorrect! Try again.
46Why is 'Allow-listing' (White-listing) input validation superior to 'Block-listing' (Black-listing)?
A.Block-listing is illegal
B.Block-listing often fails because attackers can find variations or encodings that aren't on the list
C.It is faster to write
D.Allow-listing accepts everything
Correct Answer: Block-listing often fails because attackers can find variations or encodings that aren't on the list
Explanation:
Allow-listing only accepts known good input. Block-listing attempts to block known bad input, which is impossible to do comprehensively.
Incorrect! Try again.
47In network session hijacking, what is 'Ack Storm'?
A.A type of firewall
B.A hacking tool
C.A burst of traffic caused by desynchronized sequence numbers where devices repeatedly try to synchronize
D.A weather condition affecting Wi-Fi
Correct Answer: A burst of traffic caused by desynchronized sequence numbers where devices repeatedly try to synchronize
Explanation:
When an attacker hijacks a TCP session, the victim and server get out of sync. They endlessly send ACKs to try to re-sync, causing an 'Ack Storm'.
Incorrect! Try again.
48Using an ORM (Object-Relational Mapping) framework generally reduces SQL injection risks because:
A.It automatically uses parameterized queries under the hood
B.It doesn't use SQL
C.It requires biometric authentication
D.It uses a special firewall
Correct Answer: It automatically uses parameterized queries under the hood
Explanation:
Modern ORMs handle database interaction via objects and usually abstract away raw SQL generation, defaulting to safe parameterization.
Incorrect! Try again.
49Which header helps protect against clickjacking, which can be related to session manipulation?
A.X-Frame-Options
B.Host
C.Content-Type
D.User-Agent
Correct Answer: X-Frame-Options
Explanation:
X-Frame-Options (or CSP frame-ancestors) prevents the site from being loaded in an iframe, stopping attackers from overlaying hidden frames to trick users.
Incorrect! Try again.
50When an attacker uses HAVING 1=1 in an injection, they are often trying to:
A.Delete the table
B.Force an error to reveal the table or column name in the error message
C.Speed up the query
D.Login as admin
Correct Answer: Force an error to reveal the table or column name in the error message
Explanation:
The HAVING clause requires a GROUP BY clause in most SQL dialects. Injecting it without one forces a syntax error that often reveals the current column/table name.