Explore key concepts of the OWASP Top 10 core web security risks with scenario-based questions designed to boost your understanding of common vulnerabilities, risk factors, and secure coding practices in web application security. Perfect for those interested in enhancing their security testing skills and web security awareness.
Which type of attack can occur if unsanitized user input is directly incorporated into a database query, such as a login form that passes user credentials straight to a SQL statement?
Explanation: SQL Injection happens when unvalidated input is used to construct SQL queries, allowing attackers to manipulate queries and potentially access unauthorized data. Directory Traversal targets path manipulation to access files, not databases. Buffer Overflow exploits memory handling issues and is less related to web input forms. Cross-Site Scripting involves injecting scripts into webpages, not database queries. Only SQL Injection directly relates to the scenario described.
What is a potential risk if a web application fails to implement strong password policies, such as minimum length or complexity requirements?
Explanation: Weak password policies make it easier for attackers to compromise user accounts, leading to broken authentication vulnerabilities. Security Misconfiguration involves incorrect or default configurations, not specifically password requirements. Sensitive Data Exposure is about inadequate protection of confidential data. Cross-Site Request Forgery tricks users into performing actions without consent, but does not relate to password strength. Only broken authentication addresses weak credential policies.
If a web application sends sensitive customer information, like credit card numbers, over unencrypted HTTP, which OWASP Top 10 risk does this represent?
Explanation: Transmitting sensitive information without encryption leads to sensitive data exposure, making it possible for attackers to intercept and misuse the data. Insufficient Logging refers to not keeping proper logs for security events. Insecure Deserialization involves manipulating serialized data structures. Server-Side Request Forgery means attackers trick a server into making remote requests. Only sensitive data exposure fits the scenario of unencrypted sensitive data transmission.
An application runs in production mode with default settings, unnecessary features enabled, and verbose error messages visible to users. Which OWASP Top 10 category does this risk fall under?
Explanation: Running with default settings, extra features, and detailed error messages characterizes security misconfiguration, increasing the attack surface. Broken Access Control deals with improper user privileges. Vulnerable Components covers outdated or insecure libraries. Business Logic Errors focus on flaws in application behavior, not configuration issues. Only security misconfiguration directly applies to the described scenario.
When a web page displays user comments without proper output encoding and allows scripts to execute in visitors’ browsers, what vulnerability is being introduced?
Explanation: Allowing user-supplied scripts to run in browsers due to lack of output encoding is Cross-Site Scripting (XSS), which enables attackers to hijack sessions or deface content. Cross-Site Request Forgery manipulates user actions, not browser scripts. Session Fixation involves setting or stealing session tokens, not script injection. Command Injection relates to server-side command execution. Only XSS fits the situation of untrusted scripts running in user browsers.