Injection, broken access control, XSS, CSRF, SSRF, insecure design, security misconfiguration and their mitigations.
39 cards · basic cards · AI-written, checked twice. Edit anything.
- What is an injection attack?
Show answer
An attack where untrusted data is sent as part of a command or query, causing unintended code execution.- What is SQL injection?
Show answer
An attack that inserts malicious SQL code into input fields, allowing manipulation of database queries.- Example vulnerable code: query = 'SELECT * FROM users WHERE id = ' + userId. What is the risk?
Show answer
The userId is concatenated without sanitization, allowing an attacker to modify the SQL logic.- What is command injection?
Show answer
An attack where untrusted input is used in OS commands, allowing arbitrary command execution on the server.- Why is concatenating user input into system commands dangerous?
Show answer
An attacker can inject shell metacharacters (like ; or |) to execute arbitrary commands with server privileges.- What is the primary mitigation for injection attacks?
Show answer
Use parameterized queries or prepared statements to separate code from data.- What is broken access control?
Show answer
A vulnerability where users can access resources or perform actions they are not authorized to do.- What is an Insecure Direct Object Reference (IDOR)?
Show answer
A vulnerability where an application exposes internal object references without verifying user authorization.- What is horizontal privilege escalation?
Show answer
When a user accesses or modifies resources belonging to another user at the same privilege level.- What is vertical privilege escalation?
Show answer
When a user gains higher-level permissions than they should have, such as a user becoming an admin.- What is the primary defense against access control vulnerabilities?
Show answer
Always verify user permissions server-side before granting access to any resource.- Why should access control checks never rely on client-side enforcement?
Show answer
Client-side checks can be easily bypassed by attackers who have full control of their own requests.- What is Cross-Site Scripting (XSS)?
Show answer
An attack where malicious scripts are injected into web pages and executed in victims' browsers.- What is reflected XSS?
Show answer
XSS where the malicious payload is part of the request and immediately reflected in the response without encoding.- What is stored XSS?
Show answer
XSS where the malicious payload is stored persistently in a database and executed whenever other users view it.
FlashKeepers