Top 65 Web Security Interview Questions And Answers

Question 1

What is “Vulnerability”?

Accepted Answer

The **Vulnerability** can be defined as weakness of any system through which intruders or bugs can attack on the system.

If security testing has not been performed rigorously on the system then chances of vulnerabilities get increase. Time to time patches or fixes requires preventing a system from the vulnerabilities

Question 2

List the various methodologies in Security testing?

Accepted Answer

Methodologies in Security testing are:
* **White Box** - All the information are provided to the testers.
* **Black Box** - No information is provided to the testers and they can test the system in real world scenario.
* **Grey Box** - Partial information is with the testers and rest they have to rest on their own.

Question 3

What is a botnet?

Accepted Answer

A **botnet** is a number of Internet-connected devices, each of which is running one or more bots. Botnets can be used to perform distributed denial-of-service attack (DDoS attack), steal data, send spam, and allows the attacker to access the device and its connection.

Question 4

What is the difference between Authentication vs Authorization?

Accepted Answer

* **Authentication** is the process of ascertaining that somebody really is who he claims to be.
* **Authorization** refers to rules that determine who is allowed to do what. E.g. Adam may be authorized to create and delete databases, while Usama is only authorised to read.

Or in short:
* **Authentication** = login + password (who you are)
* **Authorization** = permissions (what you are allowed to do)

Also:
* Authentication = **Verification** 
* Authorization = **Permissions**

Question 5

What is SQL injection?

Accepted Answer

Injection attacks stem from a lack of strict separation between program instructions (i.e., code) and user-provided (or external) input. This allows an attacker to inject malicious code into a data snippet.

*SQL injection* is one of the most common types of injection attack. To carry it out, an attacker provides malicious SQL statements through the application.

How to prevent:
* **Prepared statements with parameterized queries**
* **Stored procedures**
* **Input validation** - blacklist validation and whitelist validation
* **Principle of least privilege** - Application accounts shouldn’t assign DBA or admin type access onto the database server. This ensures that if an application is compromised, an attacker won’t have the rights to the database through the compromised application.

Question 6

What is a DDOS attack?

Accepted Answer

**A denial-of-service attack (DoS attack)** is an attempt to make a computer resource unavailable to its intended users.

Denial of service is typically accomplished by flooding the targeted machine or resource with superfluous requests in an attempt to overload systems and prevent some or all legitimate requests from being fulfilled.

In a **distributed denial-of-service attack (DDoS attack)**, the incoming traffic flooding the victim originates from many different sources. This effectively makes it impossible to stop the attack simply by blocking a single source.

Question 7

What is Security Testing?

Accepted Answer

Security testing can be considered most important in all type of software testing. Its main objective is to find vulnerabilities in any software (web or networking) based application and protect their data from possible attacks or intruders.

As many applications contains confidential data and needs to be protected being leaked. Software testing needs to be done periodically on such applications to identify threats and to take immediate action on them.

Question 8

What is impersonation?

Accepted Answer

Impersonation is an act of pretending to be another person. For IT Systems impersonation means that some specific users (usually Admins) could get an access to other user's data.

Question 9

What is Cross-Site Scripting (XSS)?

Accepted Answer

Cross-Site Scripting (XSS) is an attack that occurs when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.

The page provided by the server when someone requests it is unaltered. Instead, an XSS attack exploits a weakness in a page that include a variable submitted in a request to show up in raw form in the response. The page is only reflecting back what was submitted in that request.

Question 10

What is Cross Site Scripting (XSS)?

Accepted Answer

By using **Cross Site Scripting (XSS)** technique, users executed malicious scripts (also called payloads) unintentionally by clicking on untrusted links and hence, these scripts pass cookies information to attackers.

Top 65 Web Security Interview Questions

What is a DDOS attack?

What is “Vulnerability”?

What is SQL injection?

What is a botnet?

What is the difference between Authentication vs Authorization?

What is Security Testing?

List the various methodologies in Security testing?

What is Content Security Policy?

What is Cross Site Scripting (XSS)?

How can we Protect Web Applications From Forced Browsing?

Explain what threat arises from not flagging HTTP cookies with tokens as secure?

What is an SSL Certificate?

How to mitigate the SQL Injection risks?

What is Session Hijacking?

Mention what flaw arises from session tokens having poor randomness across a range of values?

What is DOM-based XSS?

What is CORS and how to enable one?

What is Intrusion Detection System (IDS)?

What is Cross-Site Scripting (XSS)?

Why is the Root Certificate important?

What is impersonation?

How can I prevent XSS?

Apart from mailing links of error pages, are there other methods of exploiting XSS?

Can XSS be prevented without modifying the source code?

List the attributes of Security Testing

How to mitigate the risk of Sensitive Data Exposure?

Name the elements of PKI

What is the difference between IDS and firewalls?

List Top 10 OWASP Vulnerabilities

Mention what threat can be avoided by having unique usernames produced with a high degree of entropy?

What information can an attacker steal using XSS?

What is Cross-Site Request Forgery?

What is PKI?

What is Cross-site request forgery and how to mitigate it?

Could you explain the difference between penetration testing and other forms of security testing?

What Is Failure to Restrict URL Access?

What is the difference between encryption, encoding, and hashing?

How to mitigate the risk of Weak authentication and session management?

What is HTTP Public Key Pinning and when to use it?

Mention what happens when an application takes user inserted data and sends it to a web browser without proper validation and escaping?

What is a Honeypot?

What is ClickJacking?

Is it possible to decrypt MD5 hashes? Explain.

If you can decode JWT, how are they secure?

How to ensure that a file can only be decrypted after a specific date?

What's the difference between OpenID and OAuth?

How does SSL/TLS work ?

Explain briefly CORS (Cross-Origin Resource Sharing)?

What is a Bug Bounty?

What is Stored XSS?

What is Reflected XSS?

What are X-Frame-Options?

What is Cross Site Tracing (XST)? How can it be prevented?

How to Prevent Breaches Due to Failure to Restrict URL Access?

What is HSTS?

What are the types of XSS?

Mention what is the basic design of OWASP ESAPI?

How to use Content Security Policy (CSP) against clickjacking?

How to use CHAP Authentication (Challenge Response Authentication) for webSockets?

How would you secure WebSockets communication on your project?

What is Content Security Policy (CSP)?

What is a Salt and How Does It Make Password Hashing More Secure?

Provide some "robots.txt" anti-pattern usage

How to check if HSTS is enabled?

How come that hash values are not reversible?