Web App Sec 3

In the OWASP 2021 web application vulnerabilities top 10 list Which of the following is No 1?

• Injection

• Broken Access Control

• Broken Authentication

• Broken Arrow

Name the attack

• Cross Site Scripting

• Xros Site Scripting

• Cross origin resource Sharing

• Cross Site Request Forgery

Which of these is not a type of Cross Site Scripting attack?

• Reflected XSS

• Stored XSS

• DOM XSS

• Cached XSS

Name the Attack

• XSS

• CSS

• CSRF

• Click jackings

Which of the following is NOT the correct method to prevent CSRF?

• inclusion of an unpredictable token in the body

• Use Captcha on all critical page

• inspect every incoming POST, PUT, PATCH, or DELETE request for a secret session value

• Avoid using null origin in your list

Consider the below original URL

https://aumscn.amrita.edu/cas/login?service=https%3A%2F%2Faumscn.amrita.edu%2Faums%2FJsp%2FCommon%2Findex.jsp

and tell if the below is a Same origin URL or different URL

https://aumscn.amrita.edu/cas/login?service=https%3A%2F%2Faumscn.amrita.edu%2Faums%2FJsp%2FCommon%2Findex.asp

• Same Origin

• Different Origin

  Reason : different port

• Different Origin

  Reason : different protocol

• Different Origin

  Reason : different host

In a regular cross-origin resource sharing (CORS) interaction some HTTP requests are considered complex and require server confirmation before the actual request is sent. The preapproval process is called ................................. request

• Advance

• Register

• Prior

• Preflight

What is Z index ?

• A CSS property that defines the order of overlapping XML elements

• The Z axis value of the Image present in a web page

• A CSS property that defines the order of overlapping HTML elements

• The Z category security project value for Web Application Security

Clickjacking attacks use CSS to create and manipulate layers.

The attacker incorporates the target website as an ............................... overlaid on the decoy website.

• mframe layer

• div layer

• iframe layer

• span layer

Name this Attack:

"Mainly In Mobile Applications, Between the time the notice is issued and the time it appears on the screen, there is a short delay with pop-up alerts. The attackers take advantage of the brief delay to build a dummy icon that you can touch beneath the real notification"

• Filejacking

• Mousejack

• CookieJacking

• Delay Jacking

• Browserless clickjacking