1What is the primary definition of Session Hijacking?
A.Unauthorized encrypted communication between two servers
B.Crashing a web server by sending too many requests
C.The exploitation of a valid computer session to gain unauthorized access to information or services
D.Phishing a user to obtain their login credentials via email
Correct Answer: The exploitation of a valid computer session to gain unauthorized access to information or services
Explanation:
Session hijacking involves an attacker taking over an active session between a user and a server after the user has authenticated.
Incorrect! Try again.
2Which of the following is a key difference between Session Hijacking and IP Spoofing?
A.Session Hijacking takes over an ongoing authenticated session; IP Spoofing creates unauthorized packets with a false source IP
B.There is no difference; they are synonymous
C.IP Spoofing takes over an active session; Hijacking initiates a new one
D.Session Hijacking only works on UDP; IP Spoofing works on TCP
Correct Answer: Session Hijacking takes over an ongoing authenticated session; IP Spoofing creates unauthorized packets with a false source IP
Explanation:
Hijacking relies on an existing valid session state, whereas spoofing is simply masking the source address, often to initiate a connection or hide identity.
Incorrect! Try again.
3In the context of TCP Session Hijacking, what must an attacker successfully predict to inject packets?
A.The User ID
B.The MAC address
C.The Sequence Number (SEQ)
D.The DNS server IP
Correct Answer: The Sequence Number (SEQ)
Explanation:
To inject data into a TCP stream, the attacker must correctly predict the next sequence number expected by the target machine.
Incorrect! Try again.
4What is 'Session Fixation'?
A.An attack where the attacker fixes the server errors
B.A defense mechanism to keep sessions stable
C.A method of fixing a static IP address to a session
D.An attack where the attacker sets a user's session ID to one known to the attacker before the user logs in
Correct Answer: An attack where the attacker sets a user's session ID to one known to the attacker before the user logs in
Explanation:
In session fixation, the attacker forces the victim to use a specific session ID, allowing the attacker to hijack the session once the user authenticates.
Incorrect! Try again.
5Which attack vector is commonly used to steal Session IDs stored in cookies?
A.Cross-Site Scripting (XSS)
B.Ping of Death
C.SQL Injection
D.Buffer Overflow
Correct Answer: Cross-Site Scripting (XSS)
Explanation:
XSS allows attackers to execute malicious scripts in the victim's browser, which can access document.cookie and send the Session ID to the attacker.
Incorrect! Try again.
6Which of the following acts as a countermeasure against Session Hijacking by encrypting data in transit?
A.Using simple HTTP
B.Disabling cookies
C.Using Telnet
D.Using SSL/TLS (HTTPS)
Correct Answer: Using SSL/TLS (HTTPS)
Explanation:
HTTPS encrypts the communication channel, making it difficult for attackers to sniff session IDs or tokens from the network traffic.
Incorrect! Try again.
7What is the purpose of the 'HttpOnly' flag in a Set-Cookie header?
A.To allow the cookie to be shared across different domains
B.To prevent client-side scripts (like JavaScript) from accessing the cookie
C.To ensure the cookie expires immediately
D.To ensure the cookie is only sent over HTTP, not HTTPS
Correct Answer: To prevent client-side scripts (like JavaScript) from accessing the cookie
Explanation:
The HttpOnly flag mitigates the risk of XSS attacks stealing session cookies by blocking JavaScript access to them.
Incorrect! Try again.
8In a Man-in-the-Middle (MITM) attack used for session hijacking, what tool is often used to manipulate the ARP cache?
A.ARP Spoofing/Poisoning
B.Nmap
C.Ping
D.Traceroute
Correct Answer: ARP Spoofing/Poisoning
Explanation:
ARP Spoofing associates the attacker's MAC address with the legitimate IP address of the gateway or victim, redirecting traffic through the attacker.
Incorrect! Try again.
9Passive Session Hijacking involves:
A.Resetting the connection
B.Monitoring and capturing traffic without altering it
C.Injecting malicious packets into the stream
D.Crashing the server
Correct Answer: Monitoring and capturing traffic without altering it
Explanation:
Passive hijacking implies sniffing the network to gather information (like credentials or session IDs) without actively disrupting or modifying the stream.
Incorrect! Try again.
10A good defensive strategy regarding Session IDs after a successful login is to:
A.Keep the same Session ID used before login
B.Regenerate a new Session ID
C.Make the Session ID static for 24 hours
D.Use the user's username as the Session ID
Correct Answer: Regenerate a new Session ID
Explanation:
Regenerating the session ID upon authentication prevents session fixation attacks where the attacker knows the pre-login ID.
Incorrect! Try again.
11In the Client-Server relationship, which entity is responsible for initiating the request?
A.Client
B.Firewall
C.Server
D.Database
Correct Answer: Client
Explanation:
The client (e.g., a web browser) initiates the communication by sending a request to the server.
Incorrect! Try again.
12Which HTTP method is generally considered less secure for transmitting sensitive data because parameters are shown in the URL?
A.CONNECT
B.GET
C.POST
D.HEAD
Correct Answer: GET
Explanation:
GET requests append data to the URL query string, which remains in browser history and server logs, exposing sensitive data.
Incorrect! Try again.
13What is 'Directory Traversal' in the context of web server vulnerabilities?
A.Indexing the website on a search engine
B.Moving files from one folder to another
C.Accessing files outside the web root folder by manipulating input (e.g., ../)
D.Traversing the network topology
Correct Answer: Accessing files outside the web root folder by manipulating input (e.g., ../)
Explanation:
Directory traversal exploits insufficient security validation of user-supplied input file names, allowing characters like '../' to access restricted parent directories.
Incorrect! Try again.
14Which of the following is a common vulnerability where a web application fails to properly filter user input before sending it to a database?
A.DNS Spoofing
B.Session Timeout
C.SQL Injection
D.Denial of Service
Correct Answer: SQL Injection
Explanation:
SQL Injection occurs when untrusted user input is concatenated directly into database commands without validation or escaping.
Incorrect! Try again.
15Web Parameter Tampering involves:
A.Changing the physical server hardware
B.Updating the web browser version
C.Deleting web server logs
D.Modifying data within form fields, URLs, or cookies to manipulate application behavior
Correct Answer: Modifying data within form fields, URLs, or cookies to manipulate application behavior
Explanation:
Attackers tamper with parameters (like price or user ID) sent from the client to the server to bypass logic or privilege checks.
Incorrect! Try again.
16Which tool is commonly used for vulnerability scanning of web applications?
A.Windows Media Player
B.Microsoft Word
C.Photoshop
D.Nikto or OWASP ZAP
Correct Answer: Nikto or OWASP ZAP
Explanation:
Nikto and OWASP ZAP are widely used tools designed to scan web servers and applications for known vulnerabilities and misconfigurations.
Incorrect! Try again.
17Why are hidden form fields dangerous if not validated by the server?
A.They make the HTML code messy
B.Users can view source, modify the hidden values, and submit them
C.They slow down the website
D.They cannot be seen by the browser
Correct Answer: Users can view source, modify the hidden values, and submit them
Explanation:
Hidden fields are just HTML text. An attacker can save the page, edit the hidden value (e.g., setting a product price to zero), and submit the form.
Incorrect! Try again.
18What does SQL stand for?
A.Simple Query Logic
B.Standard Query List
C.Structured Query Language
D.Structured Question Language
Correct Answer: Structured Query Language
Explanation:
SQL stands for Structured Query Language, the standard language for managing relational databases.
Incorrect! Try again.
19The core root cause of SQL Injection vulnerabilities is:
A.Using a firewall
B.The web server is running Linux
C.The database is too slow
D.Trusting user input and mixing code with data
Correct Answer: Trusting user input and mixing code with data
Explanation:
SQLi happens when the interpreter cannot distinguish between the intended code (the query) and the data provided by the user.
Incorrect! Try again.
20In a SQL Injection attack, what is the significance of the single quote (') character?
A.It is used to delimit strings; inserting it can break the query structure
B.It encrypts the password
C.It starts a comment
D.It deletes the database
Correct Answer: It is used to delimit strings; inserting it can break the query structure
Explanation:
Attackers use the single quote to close a data field in the code and begin injecting their own SQL commands.
Incorrect! Try again.
21What does the injection OR 1=1 typically achieve in a login bypass attack?
A.It sets the password to 1
B.It deletes the user account
C.It creates a condition that is always true, bypassing the password check
D.It causes a syntax error
Correct Answer: It creates a condition that is always true, bypassing the password check
Explanation:
Since 1 always equals 1, the database evaluates the condition as true, often returning the first record in the table (usually the admin).
Incorrect! Try again.
22Which SQL comment symbol is often used to ignore the remainder of the original query in MySQL?
A.<!-- -->
B.//
C.# or --
D.%%
Correct Answer: # or --
Explanation:
In MySQL, # or -- (dash-dash-space) comments out the rest of the query, effectively neutralizing password checks or other logic.
Incorrect! Try again.
23What is 'Blind SQL Injection'?
A.An attack where the attacker cannot see the screen
B.An attack using invisible ink
C.An attack where the database is offline
D.An attack where the database does not return data/errors to the screen, so the attacker infers data based on server behavior
Correct Answer: An attack where the database does not return data/errors to the screen, so the attacker infers data based on server behavior
Explanation:
In Blind SQLi, the attacker sends True/False questions to the DB and observes the response (time delay or content change) to extract data byte-by-byte.
Incorrect! Try again.
24Which SQL command is most dangerous regarding data loss if injected successfully?
A.INSERT
B.SELECT
C.UNION
D.DROP TABLE
Correct Answer: DROP TABLE
Explanation:
DROP TABLE removes entire tables and their data from the database, causing significant data loss.
Incorrect! Try again.
25What is a UNION-based SQL injection?
A.Injecting into the Union Bank website
B.Joining two databases physically
C.Using the UNION operator to combine the results of the original query with the results of an injected query
D.Creating a labor union for DBAs
Correct Answer: Using the UNION operator to combine the results of the original query with the results of an injected query
Explanation:
UNION allows an attacker to append the results of their own malicious SELECT query to the results of the legitimate query, displaying data on the page.
Incorrect! Try again.
26What is the most effective defense against SQL Injection?
Parameterized queries ensure the database treats user input as data, not as executable code, strictly separating the two.
Incorrect! Try again.
27How does 'Error-based SQL Injection' help an attacker?
A.It fixes errors in the code
B.It crashes the server immediately
C.It provides details about the database structure via verbose error messages
D.It creates a backup of the database
Correct Answer: It provides details about the database structure via verbose error messages
Explanation:
Attackers intentionally cause errors; if the application displays raw DB errors, it reveals table names, column types, or logic structures.
Incorrect! Try again.
28Which technique allows an attacker to evade basic pattern-matching detection systems (IDS) during SQL injection?
A.URL Encoding or Hex Encoding
B.Sending the query via email
C.Writing the query in capital letters
D.Using a faster internet connection
Correct Answer: URL Encoding or Hex Encoding
Explanation:
Encoding malicious characters (like replacing ' with %27) can sometimes bypass simple signature-based filters that look for specific plain-text strings.
Incorrect! Try again.
29What is the 'Principle of Least Privilege' in the context of database security?
A.Giving every user admin rights
B.Ensuring the database application connects with an account that has only the minimum necessary permissions
C.Using the oldest version of SQL
D.Blocking all users from the database
Correct Answer: Ensuring the database application connects with an account that has only the minimum necessary permissions
Explanation:
If the web app connects as 'sa' or 'root', an injection can destroy the whole DB. Least privilege limits the damage an attacker can do.
Incorrect! Try again.
30What is the role of a Web Application Firewall (WAF) regarding SQL Injection?
A.It encrypts the database
B.It inspects incoming HTTP traffic and blocks patterns that look like SQL injection attacks
C.It fixes the code automatically
D.It creates user backups
Correct Answer: It inspects incoming HTTP traffic and blocks patterns that look like SQL injection attacks
Explanation:
A WAF sits in front of the web server and filters malicious traffic based on rulesets, acting as a shield against known attack patterns.
Incorrect! Try again.
31When testing for SQL injection, what is 'Fuzzing'?
A.Downloading the database
B.Sending random, invalid, or unexpected data to inputs to see how the application reacts
C.Encrypting the connection
D.Cleaning the screen
Correct Answer: Sending random, invalid, or unexpected data to inputs to see how the application reacts
Explanation:
Fuzzing involves automatic injection of unexpected data (like special characters) to find crash points or error messages indicating vulnerabilities.
Incorrect! Try again.
32Which of the following represents a 'Time-based' Blind SQL Injection?
A.DROP TABLE Users
B.SELECT * FROM Users
C.UNION ALL SELECT
D.WAITFOR DELAY '0:0:10'
Correct Answer: WAITFOR DELAY '0:0:10'
Explanation:
This command instructs the database to pause for 10 seconds. If the page takes 10 seconds to load, the attacker knows their injection was executed.
Incorrect! Try again.
33In a web application, what is Input Validation?
A.Validating that the keyboard is connected
B.Checking if the user is an admin
C.Validating the server license
D.Ensuring input data meets expected criteria (type, length, format) before processing
Correct Answer: Ensuring input data meets expected criteria (type, length, format) before processing
Explanation:
Input validation checks if the data is what the application expects (e.g., ensuring an 'age' field is only a number), reducing attack surface.
Incorrect! Try again.
34What is the danger of enabling 'xp_cmdshell' in MS SQL Server?
A.It slows down queries
B.It changes the language to Spanish
C.It allows the execution of Operating System commands via SQL
D.It prevents tables from being created
Correct Answer: It allows the execution of Operating System commands via SQL
Explanation:
xp_cmdshell allows SQL Server to spawn a command shell. If an attacker injects into this, they can take control of the OS, not just the DB.
Incorrect! Try again.
35Which character is often used to chain multiple SQL queries together in a single injection (Stacking Queries)?
A.Colon (:)
B.Period (.)
C.Comma (,)
D.Semicolon (;)
Correct Answer: Semicolon (;)
Explanation:
The semicolon terminates a SQL statement. In databases that support stacked queries, an attacker can end the first query and start a new malicious one using ';'.
Incorrect! Try again.
36What is Whitespace Manipulation in the context of evading SQLi detection?
A.Deleting all spaces in the code
B.Using a larger monitor
C.Replacing spaces with other whitespace characters (like tabs or newlines) to bypass filters
D.Adding spaces to make the website look better
Correct Answer: Replacing spaces with other whitespace characters (like tabs or newlines) to bypass filters
Explanation:
If a filter blocks 'SELECT ', an attacker might write 'SELECT[tab]' or 'SELECT/*/ ' to bypass the filter while keeping valid SQL syntax.
Incorrect! Try again.
37Which of the following is an example of an 'In-band' SQL Injection?
A.The data is retrieved using the same channel (e.g., displayed on the webpage)
B.The attack is performed over the phone
C.The attacker uses a different channel to retrieve data
D.The attack relies solely on time delays
Correct Answer: The data is retrieved using the same channel (e.g., displayed on the webpage)
Explanation:
In-band SQLi (like UNION-based or Error-based) returns the results directly in the application's response to the attacker.
Incorrect! Try again.
38What is a 'stored' SQL injection?
A.The malicious code is permanently stored in the database (e.g., in a forum post) and executes later
B.The code is stored in the browser cache
C.The injection only happens once
D.The injection is stored on a USB drive
Correct Answer: The malicious code is permanently stored in the database (e.g., in a forum post) and executes later
Explanation:
Stored SQLi involves placing malicious input into the DB (like a comment field). It executes whenever the application retrieves and processes that data.
Incorrect! Try again.
39To secure cookies against session hijacking, the 'Secure' flag should be set to:
A.Ensure cookies are sent only over encrypted (HTTPS) connections
B.Allow the cookie on HTTP only
C.Encrypt the cookie content with ROT13
D.Make the cookie invisible
Correct Answer: Ensure cookies are sent only over encrypted (HTTPS) connections
Explanation:
The Secure flag prevents the browser from sending the cookie over an unencrypted HTTP connection, protecting it from network sniffing.
Incorrect! Try again.
40Which of these is NOT a valid method to test for SQL Injection?
A.Running a vulnerability scanner
B.Inputting 1=1 logic
C.Physical inspection of the server hard drive
D.Inputting a single quote into a search box
Correct Answer: Physical inspection of the server hard drive
Explanation:
Physical inspection does not reveal software logic vulnerabilities like SQL injection.
Incorrect! Try again.
41In a client-server architecture, where should security validation be most rigorously applied?
A.Server-side
B.Client-side only (JavaScript)
C.Neither
D.On the router only
Correct Answer: Server-side
Explanation:
Client-side validation can be bypassed easily (e.g., disabling JS). The server must always validate data before processing it.
Incorrect! Try again.
42How can 'Stored Procedures' help prevent SQL Injection?
A.They encapsulate queries and can accept parameters, functioning similarly to parameterized queries
B.They encrypt the hard drive
C.They make the database slower
D.They delete all data periodically
Correct Answer: They encapsulate queries and can accept parameters, functioning similarly to parameterized queries
Explanation:
When used correctly with parameters, stored procedures define the SQL logic beforehand, preventing user input from altering the query structure.
Incorrect! Try again.
43What does an attacker typically look for in a URL to attempt SQL Injection?
A.Query strings with parameters (e.g., ?id=5)
B.Static HTML pages
C.Images (.jpg)
D.CSS files
Correct Answer: Query strings with parameters (e.g., ?id=5)
Explanation:
Parameters passed in the URL (GET requests) are common vectors for injection if those parameters are used directly in a DB query.
Incorrect! Try again.
44Which of the following best describes 'Session Timeout' as a defensive strategy?
A.Slowing down the internet connection
B.Banning the user forever
C.Closing the session automatically after a period of inactivity
D.Turning off the server at night
Correct Answer: Closing the session automatically after a period of inactivity
Explanation:
Session timeouts reduce the window of opportunity for an attacker to hijack a session if a user walks away without logging out.
Incorrect! Try again.
45What is the risk of having 'Verbose Error Messages' enabled on a live production server?
A.It fills up the hard drive
B.It uses too much bandwidth
C.It looks unprofessional
D.It aids attackers in understanding the technology stack and database structure (Information Leakage)
Correct Answer: It aids attackers in understanding the technology stack and database structure (Information Leakage)
Explanation:
Detailed errors give attackers a roadmap of the internal workings, table names, and syntax required to exploit the system.
Incorrect! Try again.
46Why is 'Allow-listing' (White-listing) input validation superior to 'Block-listing' (Black-listing)?
A.It is faster to write
B.Block-listing is illegal
C.Allow-listing accepts everything
D.Block-listing often fails because attackers can find variations or encodings that aren't on the list
Correct Answer: Block-listing often fails because attackers can find variations or encodings that aren't on the list
Explanation:
Allow-listing only accepts known good input. Block-listing attempts to block known bad input, which is impossible to do comprehensively.
Incorrect! Try again.
47In network session hijacking, what is 'Ack Storm'?
A.A weather condition affecting Wi-Fi
B.A hacking tool
C.A burst of traffic caused by desynchronized sequence numbers where devices repeatedly try to synchronize
D.A type of firewall
Correct Answer: A burst of traffic caused by desynchronized sequence numbers where devices repeatedly try to synchronize
Explanation:
When an attacker hijacks a TCP session, the victim and server get out of sync. They endlessly send ACKs to try to re-sync, causing an 'Ack Storm'.
Incorrect! Try again.
48Using an ORM (Object-Relational Mapping) framework generally reduces SQL injection risks because:
A.It automatically uses parameterized queries under the hood
B.It doesn't use SQL
C.It requires biometric authentication
D.It uses a special firewall
Correct Answer: It automatically uses parameterized queries under the hood
Explanation:
Modern ORMs handle database interaction via objects and usually abstract away raw SQL generation, defaulting to safe parameterization.
Incorrect! Try again.
49Which header helps protect against clickjacking, which can be related to session manipulation?
A.User-Agent
B.Content-Type
C.X-Frame-Options
D.Host
Correct Answer: X-Frame-Options
Explanation:
X-Frame-Options (or CSP frame-ancestors) prevents the site from being loaded in an iframe, stopping attackers from overlaying hidden frames to trick users.
Incorrect! Try again.
50When an attacker uses HAVING 1=1 in an injection, they are often trying to:
A.Force an error to reveal the table or column name in the error message
B.Login as admin
C.Delete the table
D.Speed up the query
Correct Answer: Force an error to reveal the table or column name in the error message
Explanation:
The HAVING clause requires a GROUP BY clause in most SQL dialects. Injecting it without one forces a syntax error that often reveals the current column/table name.
Incorrect! Try again.
Did this save you a night before the exam?
LPU Notes is free, and it stays free. Ads cover part of the server bill.
The rest comes out of a student's own pocket: the domain, the storage,
and keeping the site up through the weeks everyone needs it at once.
The payment button didn't load. An ad blocker or a filtered network is the usual reason.
to try again.
Nothing here is ever locked, and nothing unlocks. Chip in only if it was worth it.
What it pays for →