1What is the primary definition of Session Hijacking?
A.Unauthorized encrypted communication between two servers
B.The exploitation of a valid computer session to gain unauthorized access to information or services
C.Crashing a web server by sending too many requests
D.Phishing a user to obtain their login credentials via email
Correct Answer: The exploitation of a valid computer session to gain unauthorized access to information or services
Explanation:
Session hijacking involves an attacker taking over an active session between a user and a server after the user has authenticated.
Incorrect! Try again.
2Which of the following is a key difference between Session Hijacking and IP Spoofing?
A.IP Spoofing takes over an active session; Hijacking initiates a new one
B.Session Hijacking only works on UDP; IP Spoofing works on TCP
C.There is no difference; they are synonymous
D.Session Hijacking takes over an ongoing authenticated session; IP Spoofing creates unauthorized packets with a false source IP
Correct Answer: Session Hijacking takes over an ongoing authenticated session; IP Spoofing creates unauthorized packets with a false source IP
Explanation:
Hijacking relies on an existing valid session state, whereas spoofing is simply masking the source address, often to initiate a connection or hide identity.
Incorrect! Try again.
3In the context of TCP Session Hijacking, what must an attacker successfully predict to inject packets?
A.The MAC address
B.The DNS server IP
C.The User ID
D.The Sequence Number (SEQ)
Correct Answer: The Sequence Number (SEQ)
Explanation:
To inject data into a TCP stream, the attacker must correctly predict the next sequence number expected by the target machine.
Incorrect! Try again.
4What is 'Session Fixation'?
A.A defense mechanism to keep sessions stable
B.An attack where the attacker sets a user's session ID to one known to the attacker before the user logs in
C.An attack where the attacker fixes the server errors
D.A method of fixing a static IP address to a session
Correct Answer: An attack where the attacker sets a user's session ID to one known to the attacker before the user logs in
Explanation:
In session fixation, the attacker forces the victim to use a specific session ID, allowing the attacker to hijack the session once the user authenticates.
Incorrect! Try again.
5Which attack vector is commonly used to steal Session IDs stored in cookies?
A.SQL Injection
B.Buffer Overflow
C.Ping of Death
D.Cross-Site Scripting (XSS)
Correct Answer: Cross-Site Scripting (XSS)
Explanation:
XSS allows attackers to execute malicious scripts in the victim's browser, which can access document.cookie and send the Session ID to the attacker.
Incorrect! Try again.
6Which of the following acts as a countermeasure against Session Hijacking by encrypting data in transit?
A.Disabling cookies
B.Using Telnet
C.Using simple HTTP
D.Using SSL/TLS (HTTPS)
Correct Answer: Using SSL/TLS (HTTPS)
Explanation:
HTTPS encrypts the communication channel, making it difficult for attackers to sniff session IDs or tokens from the network traffic.
Incorrect! Try again.
7What is the purpose of the 'HttpOnly' flag in a Set-Cookie header?
A.To ensure the cookie is only sent over HTTP, not HTTPS
B.To prevent client-side scripts (like JavaScript) from accessing the cookie
C.To ensure the cookie expires immediately
D.To allow the cookie to be shared across different domains
Correct Answer: To prevent client-side scripts (like JavaScript) from accessing the cookie
Explanation:
The HttpOnly flag mitigates the risk of XSS attacks stealing session cookies by blocking JavaScript access to them.
Incorrect! Try again.
8In a Man-in-the-Middle (MITM) attack used for session hijacking, what tool is often used to manipulate the ARP cache?
A.Traceroute
B.Ping
C.Nmap
D.ARP Spoofing/Poisoning
Correct Answer: ARP Spoofing/Poisoning
Explanation:
ARP Spoofing associates the attacker's MAC address with the legitimate IP address of the gateway or victim, redirecting traffic through the attacker.
Incorrect! Try again.
9Passive Session Hijacking involves:
A.Monitoring and capturing traffic without altering it
B.Crashing the server
C.Injecting malicious packets into the stream
D.Resetting the connection
Correct Answer: Monitoring and capturing traffic without altering it
Explanation:
Passive hijacking implies sniffing the network to gather information (like credentials or session IDs) without actively disrupting or modifying the stream.
Incorrect! Try again.
10A good defensive strategy regarding Session IDs after a successful login is to:
A.Regenerate a new Session ID
B.Make the Session ID static for 24 hours
C.Keep the same Session ID used before login
D.Use the user's username as the Session ID
Correct Answer: Regenerate a new Session ID
Explanation:
Regenerating the session ID upon authentication prevents session fixation attacks where the attacker knows the pre-login ID.
Incorrect! Try again.
11In the Client-Server relationship, which entity is responsible for initiating the request?
A.Firewall
B.Client
C.Database
D.Server
Correct Answer: Client
Explanation:
The client (e.g., a web browser) initiates the communication by sending a request to the server.
Incorrect! Try again.
12Which HTTP method is generally considered less secure for transmitting sensitive data because parameters are shown in the URL?
A.CONNECT
B.HEAD
C.POST
D.GET
Correct Answer: GET
Explanation:
GET requests append data to the URL query string, which remains in browser history and server logs, exposing sensitive data.
Incorrect! Try again.
13What is 'Directory Traversal' in the context of web server vulnerabilities?
A.Accessing files outside the web root folder by manipulating input (e.g., ../)
B.Traversing the network topology
C.Indexing the website on a search engine
D.Moving files from one folder to another
Correct Answer: Accessing files outside the web root folder by manipulating input (e.g., ../)
Explanation:
Directory traversal exploits insufficient security validation of user-supplied input file names, allowing characters like '../' to access restricted parent directories.
Incorrect! Try again.
14Which of the following is a common vulnerability where a web application fails to properly filter user input before sending it to a database?
A.DNS Spoofing
B.Session Timeout
C.Denial of Service
D.SQL Injection
Correct Answer: SQL Injection
Explanation:
SQL Injection occurs when untrusted user input is concatenated directly into database commands without validation or escaping.
Incorrect! Try again.
15Web Parameter Tampering involves:
A.Modifying data within form fields, URLs, or cookies to manipulate application behavior
B.Deleting web server logs
C.Updating the web browser version
D.Changing the physical server hardware
Correct Answer: Modifying data within form fields, URLs, or cookies to manipulate application behavior
Explanation:
Attackers tamper with parameters (like price or user ID) sent from the client to the server to bypass logic or privilege checks.
Incorrect! Try again.
16Which tool is commonly used for vulnerability scanning of web applications?
A.Microsoft Word
B.Windows Media Player
C.Nikto or OWASP ZAP
D.Photoshop
Correct Answer: Nikto or OWASP ZAP
Explanation:
Nikto and OWASP ZAP are widely used tools designed to scan web servers and applications for known vulnerabilities and misconfigurations.
Incorrect! Try again.
17Why are hidden form fields dangerous if not validated by the server?
A.They make the HTML code messy
B.Users can view source, modify the hidden values, and submit them
C.They slow down the website
D.They cannot be seen by the browser
Correct Answer: Users can view source, modify the hidden values, and submit them
Explanation:
Hidden fields are just HTML text. An attacker can save the page, edit the hidden value (e.g., setting a product price to zero), and submit the form.
Incorrect! Try again.
18What does SQL stand for?
A.Structured Question Language
B.Standard Query List
C.Structured Query Language
D.Simple Query Logic
Correct Answer: Structured Query Language
Explanation:
SQL stands for Structured Query Language, the standard language for managing relational databases.
Incorrect! Try again.
19The core root cause of SQL Injection vulnerabilities is:
A.Trusting user input and mixing code with data
B.The web server is running Linux
C.The database is too slow
D.Using a firewall
Correct Answer: Trusting user input and mixing code with data
Explanation:
SQLi happens when the interpreter cannot distinguish between the intended code (the query) and the data provided by the user.
Incorrect! Try again.
20In a SQL Injection attack, what is the significance of the single quote (') character?
A.It is used to delimit strings; inserting it can break the query structure
B.It deletes the database
C.It encrypts the password
D.It starts a comment
Correct Answer: It is used to delimit strings; inserting it can break the query structure
Explanation:
Attackers use the single quote to close a data field in the code and begin injecting their own SQL commands.
Incorrect! Try again.
21What does the injection OR 1=1 typically achieve in a login bypass attack?
A.It sets the password to 1
B.It causes a syntax error
C.It deletes the user account
D.It creates a condition that is always true, bypassing the password check
Correct Answer: It creates a condition that is always true, bypassing the password check
Explanation:
Since 1 always equals 1, the database evaluates the condition as true, often returning the first record in the table (usually the admin).
Incorrect! Try again.
22Which SQL comment symbol is often used to ignore the remainder of the original query in MySQL?
A.//
B.<!-- -->
C.# or --
D.%%
Correct Answer: # or --
Explanation:
In MySQL, # or -- (dash-dash-space) comments out the rest of the query, effectively neutralizing password checks or other logic.
Incorrect! Try again.
23What is 'Blind SQL Injection'?
A.An attack where the database does not return data/errors to the screen, so the attacker infers data based on server behavior
B.An attack using invisible ink
C.An attack where the attacker cannot see the screen
D.An attack where the database is offline
Correct Answer: An attack where the database does not return data/errors to the screen, so the attacker infers data based on server behavior
Explanation:
In Blind SQLi, the attacker sends True/False questions to the DB and observes the response (time delay or content change) to extract data byte-by-byte.
Incorrect! Try again.
24Which SQL command is most dangerous regarding data loss if injected successfully?
A.SELECT
B.INSERT
C.DROP TABLE
D.UNION
Correct Answer: DROP TABLE
Explanation:
DROP TABLE removes entire tables and their data from the database, causing significant data loss.
Incorrect! Try again.
25What is a UNION-based SQL injection?
A.Injecting into the Union Bank website
B.Creating a labor union for DBAs
C.Using the UNION operator to combine the results of the original query with the results of an injected query
D.Joining two databases physically
Correct Answer: Using the UNION operator to combine the results of the original query with the results of an injected query
Explanation:
UNION allows an attacker to append the results of their own malicious SELECT query to the results of the legitimate query, displaying data on the page.
Incorrect! Try again.
26What is the most effective defense against SQL Injection?
Parameterized queries ensure the database treats user input as data, not as executable code, strictly separating the two.
Incorrect! Try again.
27How does 'Error-based SQL Injection' help an attacker?
A.It provides details about the database structure via verbose error messages
B.It fixes errors in the code
C.It creates a backup of the database
D.It crashes the server immediately
Correct Answer: It provides details about the database structure via verbose error messages
Explanation:
Attackers intentionally cause errors; if the application displays raw DB errors, it reveals table names, column types, or logic structures.
Incorrect! Try again.
28Which technique allows an attacker to evade basic pattern-matching detection systems (IDS) during SQL injection?
A.Using a faster internet connection
B.URL Encoding or Hex Encoding
C.Writing the query in capital letters
D.Sending the query via email
Correct Answer: URL Encoding or Hex Encoding
Explanation:
Encoding malicious characters (like replacing ' with %27) can sometimes bypass simple signature-based filters that look for specific plain-text strings.
Incorrect! Try again.
29What is the 'Principle of Least Privilege' in the context of database security?
A.Ensuring the database application connects with an account that has only the minimum necessary permissions
B.Blocking all users from the database
C.Using the oldest version of SQL
D.Giving every user admin rights
Correct Answer: Ensuring the database application connects with an account that has only the minimum necessary permissions
Explanation:
If the web app connects as 'sa' or 'root', an injection can destroy the whole DB. Least privilege limits the damage an attacker can do.
Incorrect! Try again.
30What is the role of a Web Application Firewall (WAF) regarding SQL Injection?
A.It encrypts the database
B.It inspects incoming HTTP traffic and blocks patterns that look like SQL injection attacks
C.It fixes the code automatically
D.It creates user backups
Correct Answer: It inspects incoming HTTP traffic and blocks patterns that look like SQL injection attacks
Explanation:
A WAF sits in front of the web server and filters malicious traffic based on rulesets, acting as a shield against known attack patterns.
Incorrect! Try again.
31When testing for SQL injection, what is 'Fuzzing'?
A.Downloading the database
B.Sending random, invalid, or unexpected data to inputs to see how the application reacts
C.Cleaning the screen
D.Encrypting the connection
Correct Answer: Sending random, invalid, or unexpected data to inputs to see how the application reacts
Explanation:
Fuzzing involves automatic injection of unexpected data (like special characters) to find crash points or error messages indicating vulnerabilities.
Incorrect! Try again.
32Which of the following represents a 'Time-based' Blind SQL Injection?
A.DROP TABLE Users
B.WAITFOR DELAY '0:0:10'
C.UNION ALL SELECT
D.SELECT * FROM Users
Correct Answer: WAITFOR DELAY '0:0:10'
Explanation:
This command instructs the database to pause for 10 seconds. If the page takes 10 seconds to load, the attacker knows their injection was executed.
Incorrect! Try again.
33In a web application, what is Input Validation?
A.Validating the server license
B.Checking if the user is an admin
C.Ensuring input data meets expected criteria (type, length, format) before processing
D.Validating that the keyboard is connected
Correct Answer: Ensuring input data meets expected criteria (type, length, format) before processing
Explanation:
Input validation checks if the data is what the application expects (e.g., ensuring an 'age' field is only a number), reducing attack surface.
Incorrect! Try again.
34What is the danger of enabling 'xp_cmdshell' in MS SQL Server?
A.It allows the execution of Operating System commands via SQL
B.It changes the language to Spanish
C.It prevents tables from being created
D.It slows down queries
Correct Answer: It allows the execution of Operating System commands via SQL
Explanation:
xp_cmdshell allows SQL Server to spawn a command shell. If an attacker injects into this, they can take control of the OS, not just the DB.
Incorrect! Try again.
35Which character is often used to chain multiple SQL queries together in a single injection (Stacking Queries)?
A.Period (.)
B.Comma (,)
C.Semicolon (;)
D.Colon (:)
Correct Answer: Semicolon (;)
Explanation:
The semicolon terminates a SQL statement. In databases that support stacked queries, an attacker can end the first query and start a new malicious one using ';'.
Incorrect! Try again.
36What is Whitespace Manipulation in the context of evading SQLi detection?
A.Replacing spaces with other whitespace characters (like tabs or newlines) to bypass filters
B.Adding spaces to make the website look better
C.Using a larger monitor
D.Deleting all spaces in the code
Correct Answer: Replacing spaces with other whitespace characters (like tabs or newlines) to bypass filters
Explanation:
If a filter blocks 'SELECT ', an attacker might write 'SELECT[tab]' or 'SELECT/*/ ' to bypass the filter while keeping valid SQL syntax.
Incorrect! Try again.
37Which of the following is an example of an 'In-band' SQL Injection?
A.The attack relies solely on time delays
B.The attack is performed over the phone
C.The data is retrieved using the same channel (e.g., displayed on the webpage)
D.The attacker uses a different channel to retrieve data
Correct Answer: The data is retrieved using the same channel (e.g., displayed on the webpage)
Explanation:
In-band SQLi (like UNION-based or Error-based) returns the results directly in the application's response to the attacker.
Incorrect! Try again.
38What is a 'stored' SQL injection?
A.The code is stored in the browser cache
B.The injection only happens once
C.The injection is stored on a USB drive
D.The malicious code is permanently stored in the database (e.g., in a forum post) and executes later
Correct Answer: The malicious code is permanently stored in the database (e.g., in a forum post) and executes later
Explanation:
Stored SQLi involves placing malicious input into the DB (like a comment field). It executes whenever the application retrieves and processes that data.
Incorrect! Try again.
39To secure cookies against session hijacking, the 'Secure' flag should be set to:
A.Ensure cookies are sent only over encrypted (HTTPS) connections
B.Make the cookie invisible
C.Allow the cookie on HTTP only
D.Encrypt the cookie content with ROT13
Correct Answer: Ensure cookies are sent only over encrypted (HTTPS) connections
Explanation:
The Secure flag prevents the browser from sending the cookie over an unencrypted HTTP connection, protecting it from network sniffing.
Incorrect! Try again.
40Which of these is NOT a valid method to test for SQL Injection?
A.Physical inspection of the server hard drive
B.Running a vulnerability scanner
C.Inputting a single quote into a search box
D.Inputting 1=1 logic
Correct Answer: Physical inspection of the server hard drive
Explanation:
Physical inspection does not reveal software logic vulnerabilities like SQL injection.
Incorrect! Try again.
41In a client-server architecture, where should security validation be most rigorously applied?
A.Server-side
B.On the router only
C.Neither
D.Client-side only (JavaScript)
Correct Answer: Server-side
Explanation:
Client-side validation can be bypassed easily (e.g., disabling JS). The server must always validate data before processing it.
Incorrect! Try again.
42How can 'Stored Procedures' help prevent SQL Injection?
A.They make the database slower
B.They encapsulate queries and can accept parameters, functioning similarly to parameterized queries
C.They encrypt the hard drive
D.They delete all data periodically
Correct Answer: They encapsulate queries and can accept parameters, functioning similarly to parameterized queries
Explanation:
When used correctly with parameters, stored procedures define the SQL logic beforehand, preventing user input from altering the query structure.
Incorrect! Try again.
43What does an attacker typically look for in a URL to attempt SQL Injection?
A.Images (.jpg)
B.Query strings with parameters (e.g., ?id=5)
C.CSS files
D.Static HTML pages
Correct Answer: Query strings with parameters (e.g., ?id=5)
Explanation:
Parameters passed in the URL (GET requests) are common vectors for injection if those parameters are used directly in a DB query.
Incorrect! Try again.
44Which of the following best describes 'Session Timeout' as a defensive strategy?
A.Slowing down the internet connection
B.Closing the session automatically after a period of inactivity
C.Turning off the server at night
D.Banning the user forever
Correct Answer: Closing the session automatically after a period of inactivity
Explanation:
Session timeouts reduce the window of opportunity for an attacker to hijack a session if a user walks away without logging out.
Incorrect! Try again.
45What is the risk of having 'Verbose Error Messages' enabled on a live production server?
A.It looks unprofessional
B.It aids attackers in understanding the technology stack and database structure (Information Leakage)
C.It fills up the hard drive
D.It uses too much bandwidth
Correct Answer: It aids attackers in understanding the technology stack and database structure (Information Leakage)
Explanation:
Detailed errors give attackers a roadmap of the internal workings, table names, and syntax required to exploit the system.
Incorrect! Try again.
46Why is 'Allow-listing' (White-listing) input validation superior to 'Block-listing' (Black-listing)?
A.Block-listing is illegal
B.Allow-listing accepts everything
C.It is faster to write
D.Block-listing often fails because attackers can find variations or encodings that aren't on the list
Correct Answer: Block-listing often fails because attackers can find variations or encodings that aren't on the list
Explanation:
Allow-listing only accepts known good input. Block-listing attempts to block known bad input, which is impossible to do comprehensively.
Incorrect! Try again.
47In network session hijacking, what is 'Ack Storm'?
A.A hacking tool
B.A type of firewall
C.A burst of traffic caused by desynchronized sequence numbers where devices repeatedly try to synchronize
D.A weather condition affecting Wi-Fi
Correct Answer: A burst of traffic caused by desynchronized sequence numbers where devices repeatedly try to synchronize
Explanation:
When an attacker hijacks a TCP session, the victim and server get out of sync. They endlessly send ACKs to try to re-sync, causing an 'Ack Storm'.
Incorrect! Try again.
48Using an ORM (Object-Relational Mapping) framework generally reduces SQL injection risks because:
A.It uses a special firewall
B.It automatically uses parameterized queries under the hood
C.It requires biometric authentication
D.It doesn't use SQL
Correct Answer: It automatically uses parameterized queries under the hood
Explanation:
Modern ORMs handle database interaction via objects and usually abstract away raw SQL generation, defaulting to safe parameterization.
Incorrect! Try again.
49Which header helps protect against clickjacking, which can be related to session manipulation?
A.User-Agent
B.Host
C.X-Frame-Options
D.Content-Type
Correct Answer: X-Frame-Options
Explanation:
X-Frame-Options (or CSP frame-ancestors) prevents the site from being loaded in an iframe, stopping attackers from overlaying hidden frames to trick users.
Incorrect! Try again.
50When an attacker uses HAVING 1=1 in an injection, they are often trying to:
A.Login as admin
B.Force an error to reveal the table or column name in the error message
C.Speed up the query
D.Delete the table
Correct Answer: Force an error to reveal the table or column name in the error message
Explanation:
The HAVING clause requires a GROUP BY clause in most SQL dialects. Injecting it without one forces a syntax error that often reveals the current column/table name.