1What is the primary definition of Session Hijacking?
A.Crashing a web server by sending too many requests
B.The exploitation of a valid computer session to gain unauthorized access to information or services
C.Unauthorized encrypted communication between two servers
D.Phishing a user to obtain their login credentials via email
Correct Answer: The exploitation of a valid computer session to gain unauthorized access to information or services
Explanation:
Session hijacking involves an attacker taking over an active session between a user and a server after the user has authenticated.
Incorrect! Try again.
2Which of the following is a key difference between Session Hijacking and IP Spoofing?
A.IP Spoofing takes over an active session; Hijacking initiates a new one
B.Session Hijacking takes over an ongoing authenticated session; IP Spoofing creates unauthorized packets with a false source IP
C.There is no difference; they are synonymous
D.Session Hijacking only works on UDP; IP Spoofing works on TCP
Correct Answer: Session Hijacking takes over an ongoing authenticated session; IP Spoofing creates unauthorized packets with a false source IP
Explanation:
Hijacking relies on an existing valid session state, whereas spoofing is simply masking the source address, often to initiate a connection or hide identity.
Incorrect! Try again.
3In the context of TCP Session Hijacking, what must an attacker successfully predict to inject packets?
A.The Sequence Number (SEQ)
B.The DNS server IP
C.The User ID
D.The MAC address
Correct Answer: The Sequence Number (SEQ)
Explanation:
To inject data into a TCP stream, the attacker must correctly predict the next sequence number expected by the target machine.
Incorrect! Try again.
4What is 'Session Fixation'?
A.A method of fixing a static IP address to a session
B.An attack where the attacker fixes the server errors
C.A defense mechanism to keep sessions stable
D.An attack where the attacker sets a user's session ID to one known to the attacker before the user logs in
Correct Answer: An attack where the attacker sets a user's session ID to one known to the attacker before the user logs in
Explanation:
In session fixation, the attacker forces the victim to use a specific session ID, allowing the attacker to hijack the session once the user authenticates.
Incorrect! Try again.
5Which attack vector is commonly used to steal Session IDs stored in cookies?
A.SQL Injection
B.Buffer Overflow
C.Ping of Death
D.Cross-Site Scripting (XSS)
Correct Answer: Cross-Site Scripting (XSS)
Explanation:
XSS allows attackers to execute malicious scripts in the victim's browser, which can access document.cookie and send the Session ID to the attacker.
Incorrect! Try again.
6Which of the following acts as a countermeasure against Session Hijacking by encrypting data in transit?
A.Using simple HTTP
B.Disabling cookies
C.Using SSL/TLS (HTTPS)
D.Using Telnet
Correct Answer: Using SSL/TLS (HTTPS)
Explanation:
HTTPS encrypts the communication channel, making it difficult for attackers to sniff session IDs or tokens from the network traffic.
Incorrect! Try again.
7What is the purpose of the 'HttpOnly' flag in a Set-Cookie header?
A.To ensure the cookie is only sent over HTTP, not HTTPS
B.To ensure the cookie expires immediately
C.To allow the cookie to be shared across different domains
D.To prevent client-side scripts (like JavaScript) from accessing the cookie
Correct Answer: To prevent client-side scripts (like JavaScript) from accessing the cookie
Explanation:
The HttpOnly flag mitigates the risk of XSS attacks stealing session cookies by blocking JavaScript access to them.
Incorrect! Try again.
8In a Man-in-the-Middle (MITM) attack used for session hijacking, what tool is often used to manipulate the ARP cache?
A.ARP Spoofing/Poisoning
B.Traceroute
C.Nmap
D.Ping
Correct Answer: ARP Spoofing/Poisoning
Explanation:
ARP Spoofing associates the attacker's MAC address with the legitimate IP address of the gateway or victim, redirecting traffic through the attacker.
Incorrect! Try again.
9Passive Session Hijacking involves:
A.Injecting malicious packets into the stream
B.Crashing the server
C.Resetting the connection
D.Monitoring and capturing traffic without altering it
Correct Answer: Monitoring and capturing traffic without altering it
Explanation:
Passive hijacking implies sniffing the network to gather information (like credentials or session IDs) without actively disrupting or modifying the stream.
Incorrect! Try again.
10A good defensive strategy regarding Session IDs after a successful login is to:
A.Use the user's username as the Session ID
B.Regenerate a new Session ID
C.Keep the same Session ID used before login
D.Make the Session ID static for 24 hours
Correct Answer: Regenerate a new Session ID
Explanation:
Regenerating the session ID upon authentication prevents session fixation attacks where the attacker knows the pre-login ID.
Incorrect! Try again.
11In the Client-Server relationship, which entity is responsible for initiating the request?
A.Database
B.Client
C.Firewall
D.Server
Correct Answer: Client
Explanation:
The client (e.g., a web browser) initiates the communication by sending a request to the server.
Incorrect! Try again.
12Which HTTP method is generally considered less secure for transmitting sensitive data because parameters are shown in the URL?
A.GET
B.POST
C.CONNECT
D.HEAD
Correct Answer: GET
Explanation:
GET requests append data to the URL query string, which remains in browser history and server logs, exposing sensitive data.
Incorrect! Try again.
13What is 'Directory Traversal' in the context of web server vulnerabilities?
A.Accessing files outside the web root folder by manipulating input (e.g., ../)
B.Traversing the network topology
C.Moving files from one folder to another
D.Indexing the website on a search engine
Correct Answer: Accessing files outside the web root folder by manipulating input (e.g., ../)
Explanation:
Directory traversal exploits insufficient security validation of user-supplied input file names, allowing characters like '../' to access restricted parent directories.
Incorrect! Try again.
14Which of the following is a common vulnerability where a web application fails to properly filter user input before sending it to a database?
A.Denial of Service
B.SQL Injection
C.Session Timeout
D.DNS Spoofing
Correct Answer: SQL Injection
Explanation:
SQL Injection occurs when untrusted user input is concatenated directly into database commands without validation or escaping.
Incorrect! Try again.
15Web Parameter Tampering involves:
A.Updating the web browser version
B.Deleting web server logs
C.Changing the physical server hardware
D.Modifying data within form fields, URLs, or cookies to manipulate application behavior
Correct Answer: Modifying data within form fields, URLs, or cookies to manipulate application behavior
Explanation:
Attackers tamper with parameters (like price or user ID) sent from the client to the server to bypass logic or privilege checks.
Incorrect! Try again.
16Which tool is commonly used for vulnerability scanning of web applications?
A.Microsoft Word
B.Windows Media Player
C.Photoshop
D.Nikto or OWASP ZAP
Correct Answer: Nikto or OWASP ZAP
Explanation:
Nikto and OWASP ZAP are widely used tools designed to scan web servers and applications for known vulnerabilities and misconfigurations.
Incorrect! Try again.
17Why are hidden form fields dangerous if not validated by the server?
A.They slow down the website
B.Users can view source, modify the hidden values, and submit them
C.They cannot be seen by the browser
D.They make the HTML code messy
Correct Answer: Users can view source, modify the hidden values, and submit them
Explanation:
Hidden fields are just HTML text. An attacker can save the page, edit the hidden value (e.g., setting a product price to zero), and submit the form.
Incorrect! Try again.
18What does SQL stand for?
A.Structured Question Language
B.Simple Query Logic
C.Structured Query Language
D.Standard Query List
Correct Answer: Structured Query Language
Explanation:
SQL stands for Structured Query Language, the standard language for managing relational databases.
Incorrect! Try again.
19The core root cause of SQL Injection vulnerabilities is:
A.The web server is running Linux
B.The database is too slow
C.Trusting user input and mixing code with data
D.Using a firewall
Correct Answer: Trusting user input and mixing code with data
Explanation:
SQLi happens when the interpreter cannot distinguish between the intended code (the query) and the data provided by the user.
Incorrect! Try again.
20In a SQL Injection attack, what is the significance of the single quote (') character?
A.It is used to delimit strings; inserting it can break the query structure
B.It deletes the database
C.It encrypts the password
D.It starts a comment
Correct Answer: It is used to delimit strings; inserting it can break the query structure
Explanation:
Attackers use the single quote to close a data field in the code and begin injecting their own SQL commands.
Incorrect! Try again.
21What does the injection OR 1=1 typically achieve in a login bypass attack?
A.It creates a condition that is always true, bypassing the password check
B.It causes a syntax error
C.It deletes the user account
D.It sets the password to 1
Correct Answer: It creates a condition that is always true, bypassing the password check
Explanation:
Since 1 always equals 1, the database evaluates the condition as true, often returning the first record in the table (usually the admin).
Incorrect! Try again.
22Which SQL comment symbol is often used to ignore the remainder of the original query in MySQL?
A.<!-- -->
B.//
C.%%
D.# or --
Correct Answer: # or --
Explanation:
In MySQL, # or -- (dash-dash-space) comments out the rest of the query, effectively neutralizing password checks or other logic.
Incorrect! Try again.
23What is 'Blind SQL Injection'?
A.An attack where the database is offline
B.An attack where the database does not return data/errors to the screen, so the attacker infers data based on server behavior
C.An attack using invisible ink
D.An attack where the attacker cannot see the screen
Correct Answer: An attack where the database does not return data/errors to the screen, so the attacker infers data based on server behavior
Explanation:
In Blind SQLi, the attacker sends True/False questions to the DB and observes the response (time delay or content change) to extract data byte-by-byte.
Incorrect! Try again.
24Which SQL command is most dangerous regarding data loss if injected successfully?
A.INSERT
B.UNION
C.DROP TABLE
D.SELECT
Correct Answer: DROP TABLE
Explanation:
DROP TABLE removes entire tables and their data from the database, causing significant data loss.
Incorrect! Try again.
25What is a UNION-based SQL injection?
A.Creating a labor union for DBAs
B.Injecting into the Union Bank website
C.Joining two databases physically
D.Using the UNION operator to combine the results of the original query with the results of an injected query
Correct Answer: Using the UNION operator to combine the results of the original query with the results of an injected query
Explanation:
UNION allows an attacker to append the results of their own malicious SELECT query to the results of the legitimate query, displaying data on the page.
Incorrect! Try again.
26What is the most effective defense against SQL Injection?
Parameterized queries ensure the database treats user input as data, not as executable code, strictly separating the two.
Incorrect! Try again.
27How does 'Error-based SQL Injection' help an attacker?
A.It creates a backup of the database
B.It crashes the server immediately
C.It fixes errors in the code
D.It provides details about the database structure via verbose error messages
Correct Answer: It provides details about the database structure via verbose error messages
Explanation:
Attackers intentionally cause errors; if the application displays raw DB errors, it reveals table names, column types, or logic structures.
Incorrect! Try again.
28Which technique allows an attacker to evade basic pattern-matching detection systems (IDS) during SQL injection?
A.Using a faster internet connection
B.Sending the query via email
C.URL Encoding or Hex Encoding
D.Writing the query in capital letters
Correct Answer: URL Encoding or Hex Encoding
Explanation:
Encoding malicious characters (like replacing ' with %27) can sometimes bypass simple signature-based filters that look for specific plain-text strings.
Incorrect! Try again.
29What is the 'Principle of Least Privilege' in the context of database security?
A.Using the oldest version of SQL
B.Giving every user admin rights
C.Blocking all users from the database
D.Ensuring the database application connects with an account that has only the minimum necessary permissions
Correct Answer: Ensuring the database application connects with an account that has only the minimum necessary permissions
Explanation:
If the web app connects as 'sa' or 'root', an injection can destroy the whole DB. Least privilege limits the damage an attacker can do.
Incorrect! Try again.
30What is the role of a Web Application Firewall (WAF) regarding SQL Injection?
A.It fixes the code automatically
B.It encrypts the database
C.It creates user backups
D.It inspects incoming HTTP traffic and blocks patterns that look like SQL injection attacks
Correct Answer: It inspects incoming HTTP traffic and blocks patterns that look like SQL injection attacks
Explanation:
A WAF sits in front of the web server and filters malicious traffic based on rulesets, acting as a shield against known attack patterns.
Incorrect! Try again.
31When testing for SQL injection, what is 'Fuzzing'?
A.Downloading the database
B.Encrypting the connection
C.Sending random, invalid, or unexpected data to inputs to see how the application reacts
D.Cleaning the screen
Correct Answer: Sending random, invalid, or unexpected data to inputs to see how the application reacts
Explanation:
Fuzzing involves automatic injection of unexpected data (like special characters) to find crash points or error messages indicating vulnerabilities.
Incorrect! Try again.
32Which of the following represents a 'Time-based' Blind SQL Injection?
A.UNION ALL SELECT
B.WAITFOR DELAY '0:0:10'
C.SELECT * FROM Users
D.DROP TABLE Users
Correct Answer: WAITFOR DELAY '0:0:10'
Explanation:
This command instructs the database to pause for 10 seconds. If the page takes 10 seconds to load, the attacker knows their injection was executed.
Incorrect! Try again.
33In a web application, what is Input Validation?
A.Checking if the user is an admin
B.Ensuring input data meets expected criteria (type, length, format) before processing
C.Validating that the keyboard is connected
D.Validating the server license
Correct Answer: Ensuring input data meets expected criteria (type, length, format) before processing
Explanation:
Input validation checks if the data is what the application expects (e.g., ensuring an 'age' field is only a number), reducing attack surface.
Incorrect! Try again.
34What is the danger of enabling 'xp_cmdshell' in MS SQL Server?
A.It slows down queries
B.It changes the language to Spanish
C.It allows the execution of Operating System commands via SQL
D.It prevents tables from being created
Correct Answer: It allows the execution of Operating System commands via SQL
Explanation:
xp_cmdshell allows SQL Server to spawn a command shell. If an attacker injects into this, they can take control of the OS, not just the DB.
Incorrect! Try again.
35Which character is often used to chain multiple SQL queries together in a single injection (Stacking Queries)?
A.Period (.)
B.Comma (,)
C.Semicolon (;)
D.Colon (:)
Correct Answer: Semicolon (;)
Explanation:
The semicolon terminates a SQL statement. In databases that support stacked queries, an attacker can end the first query and start a new malicious one using ';'.
Incorrect! Try again.
36What is Whitespace Manipulation in the context of evading SQLi detection?
A.Replacing spaces with other whitespace characters (like tabs or newlines) to bypass filters
B.Deleting all spaces in the code
C.Using a larger monitor
D.Adding spaces to make the website look better
Correct Answer: Replacing spaces with other whitespace characters (like tabs or newlines) to bypass filters
Explanation:
If a filter blocks 'SELECT ', an attacker might write 'SELECT[tab]' or 'SELECT/*/ ' to bypass the filter while keeping valid SQL syntax.
Incorrect! Try again.
37Which of the following is an example of an 'In-band' SQL Injection?
A.The attacker uses a different channel to retrieve data
B.The attack is performed over the phone
C.The data is retrieved using the same channel (e.g., displayed on the webpage)
D.The attack relies solely on time delays
Correct Answer: The data is retrieved using the same channel (e.g., displayed on the webpage)
Explanation:
In-band SQLi (like UNION-based or Error-based) returns the results directly in the application's response to the attacker.
Incorrect! Try again.
38What is a 'stored' SQL injection?
A.The injection only happens once
B.The malicious code is permanently stored in the database (e.g., in a forum post) and executes later
C.The code is stored in the browser cache
D.The injection is stored on a USB drive
Correct Answer: The malicious code is permanently stored in the database (e.g., in a forum post) and executes later
Explanation:
Stored SQLi involves placing malicious input into the DB (like a comment field). It executes whenever the application retrieves and processes that data.
Incorrect! Try again.
39To secure cookies against session hijacking, the 'Secure' flag should be set to:
A.Allow the cookie on HTTP only
B.Make the cookie invisible
C.Ensure cookies are sent only over encrypted (HTTPS) connections
D.Encrypt the cookie content with ROT13
Correct Answer: Ensure cookies are sent only over encrypted (HTTPS) connections
Explanation:
The Secure flag prevents the browser from sending the cookie over an unencrypted HTTP connection, protecting it from network sniffing.
Incorrect! Try again.
40Which of these is NOT a valid method to test for SQL Injection?
A.Physical inspection of the server hard drive
B.Inputting 1=1 logic
C.Running a vulnerability scanner
D.Inputting a single quote into a search box
Correct Answer: Physical inspection of the server hard drive
Explanation:
Physical inspection does not reveal software logic vulnerabilities like SQL injection.
Incorrect! Try again.
41In a client-server architecture, where should security validation be most rigorously applied?
A.On the router only
B.Server-side
C.Client-side only (JavaScript)
D.Neither
Correct Answer: Server-side
Explanation:
Client-side validation can be bypassed easily (e.g., disabling JS). The server must always validate data before processing it.
Incorrect! Try again.
42How can 'Stored Procedures' help prevent SQL Injection?
A.They encrypt the hard drive
B.They encapsulate queries and can accept parameters, functioning similarly to parameterized queries
C.They make the database slower
D.They delete all data periodically
Correct Answer: They encapsulate queries and can accept parameters, functioning similarly to parameterized queries
Explanation:
When used correctly with parameters, stored procedures define the SQL logic beforehand, preventing user input from altering the query structure.
Incorrect! Try again.
43What does an attacker typically look for in a URL to attempt SQL Injection?
A.Static HTML pages
B.CSS files
C.Images (.jpg)
D.Query strings with parameters (e.g., ?id=5)
Correct Answer: Query strings with parameters (e.g., ?id=5)
Explanation:
Parameters passed in the URL (GET requests) are common vectors for injection if those parameters are used directly in a DB query.
Incorrect! Try again.
44Which of the following best describes 'Session Timeout' as a defensive strategy?
A.Turning off the server at night
B.Closing the session automatically after a period of inactivity
C.Slowing down the internet connection
D.Banning the user forever
Correct Answer: Closing the session automatically after a period of inactivity
Explanation:
Session timeouts reduce the window of opportunity for an attacker to hijack a session if a user walks away without logging out.
Incorrect! Try again.
45What is the risk of having 'Verbose Error Messages' enabled on a live production server?
A.It looks unprofessional
B.It uses too much bandwidth
C.It aids attackers in understanding the technology stack and database structure (Information Leakage)
D.It fills up the hard drive
Correct Answer: It aids attackers in understanding the technology stack and database structure (Information Leakage)
Explanation:
Detailed errors give attackers a roadmap of the internal workings, table names, and syntax required to exploit the system.
Incorrect! Try again.
46Why is 'Allow-listing' (White-listing) input validation superior to 'Block-listing' (Black-listing)?
A.Block-listing often fails because attackers can find variations or encodings that aren't on the list
B.It is faster to write
C.Allow-listing accepts everything
D.Block-listing is illegal
Correct Answer: Block-listing often fails because attackers can find variations or encodings that aren't on the list
Explanation:
Allow-listing only accepts known good input. Block-listing attempts to block known bad input, which is impossible to do comprehensively.
Incorrect! Try again.
47In network session hijacking, what is 'Ack Storm'?
A.A weather condition affecting Wi-Fi
B.A type of firewall
C.A burst of traffic caused by desynchronized sequence numbers where devices repeatedly try to synchronize
D.A hacking tool
Correct Answer: A burst of traffic caused by desynchronized sequence numbers where devices repeatedly try to synchronize
Explanation:
When an attacker hijacks a TCP session, the victim and server get out of sync. They endlessly send ACKs to try to re-sync, causing an 'Ack Storm'.
Incorrect! Try again.
48Using an ORM (Object-Relational Mapping) framework generally reduces SQL injection risks because:
A.It doesn't use SQL
B.It automatically uses parameterized queries under the hood
C.It uses a special firewall
D.It requires biometric authentication
Correct Answer: It automatically uses parameterized queries under the hood
Explanation:
Modern ORMs handle database interaction via objects and usually abstract away raw SQL generation, defaulting to safe parameterization.
Incorrect! Try again.
49Which header helps protect against clickjacking, which can be related to session manipulation?
A.User-Agent
B.Host
C.Content-Type
D.X-Frame-Options
Correct Answer: X-Frame-Options
Explanation:
X-Frame-Options (or CSP frame-ancestors) prevents the site from being loaded in an iframe, stopping attackers from overlaying hidden frames to trick users.
Incorrect! Try again.
50When an attacker uses HAVING 1=1 in an injection, they are often trying to:
A.Speed up the query
B.Login as admin
C.Delete the table
D.Force an error to reveal the table or column name in the error message
Correct Answer: Force an error to reveal the table or column name in the error message
Explanation:
The HAVING clause requires a GROUP BY clause in most SQL dialects. Injecting it without one forces a syntax error that often reveals the current column/table name.