Q1. Bret is a web application administrator and has just read that there are a number of surprisingly common web application vulnerabilities that can be exploited by unsophisticated attackers with easily available tools on the Internet. 

He has also read that when an organization deploys a web application, they invite the world to send HTTP requests. Attacks buried in these requests sail past firewalls, filters, platform hardening, SSL, and IDS without notice because they are inside legal HTTP requests. Bret is determined to weed out any vulnerabilities. What are some common vulnerabilities in web applications that he should be concerned about? 

A. Non-validated parameters, broken access control, broken account and session management, cross-side scripting and buffer overflows are just a few common vulnerabilities 

B. No IDS configured, anonymous user account set as default, missing latest security patch, no firewall filters set and visible clear text passwords are just a few common vulnerabilities 

C. Visible clear text passwords, anonymous user account set as default, missing latest security patch, no firewall filters set and no SSL configured are just a few common vulnerabilities 

D. No SSL configured, anonymous user account set as default, missing latest security patch, no firewall filters set and an inattentive system administrator are just a few common vulnerabilities 

View Answer

Q2. Blane is a security analyst for a law firm. One of the lawyers needs to send out an email to a client but he wants to know if the email is forwarded on to any other recipients. The client is explicitly asked not to re-send the email since that would be a violation of the lawyer's and client's agreement for this particular case. What can Blane use to accomplish this? 

A. He can use a split-DNS service to ensure the email is not forwarded on. 

B. A service such as HTTrack would accomplish this. 

C. Blane could use MetaGoofil tracking tool. 

D. Blane can use a service such as ReadNotify tracking tool. 

View Answer

Q3. You want to perform advanced SQL Injection attack against a vulnerable website. You are unable to perform command shell hacks on this server. What must be enabled in SQL Server to launch these attacks? 

A. System services 

B. EXEC master access 

C. xp_cmdshell 

D. RDC 

View Answer

Q4. The GET method should never be used when sensitive data such as credit is being sent to a CGI program. This is because any GET command will appear in the URL and will be logged by any servers. For example, let’s say that you’ve entered your credit card information into a form that uses the GET method. The URL may appear like this: 

https://www.xsecurity-bank.com/creditcard.asp?cardnumber=454543433532234 

The GET method appends the credit card number to the URL. This means that anyone with access to a server log will be able to obtain this information. 

How would you protect from this type of attack? 

A. Replace the GET with POST method when sending data 

B. Never include sensitive information in a script 

C. Use HTTOS SSLV3 to send the data instead of plain HTTPS 

D. Encrypt the data before you send using GET method 

View Answer

Q5. Your lab partner is trying to find out more information about a competitors web site. The site has a .com extension. She has decided to use some online whois tools and look in one of the regional Internet registrys. Which one would you suggest she looks in first? 

A. LACNIC 

B. ARIN 

C. APNIC 

D. RIPE 

E. AfriNIC 

View Answer

Q6. The following excerpt is taken from a honeypot log. The log captures activities across three days. There are several intrusion attempts; however, a few are successful. From the options given below choose the one best interprets the following entry: 

Apr 26 06:43:05 [6282] IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 

(Note: The objective of this question is to test whether the student can read basic information from log entries and interpret the nature of attack.) 

Interpret the following entry: 

Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107.53 

A. An IDS evasion technique 

B. A buffer overflow attempt 

C. A DNS zone transfer 

D. Data being retrieved from 63.226.81.13. 

View Answer

Q7. Ursula is a college student at a University in Amsterdam. Ursula originally went to college to study engineering but later changed to marine biology after spending a month at sea with her friends. These friends frequently go out to sea to follow and harass fishing fleets that illegally fish in foreign waters. Ursula eventually wants to put companies practicing illegal fishing out of business. Ursula decides to hack into the parent company's computers and destroy critical data knowing fully well that, if caught, she probably would be sent to jail for a very long time. What would Ursula be considered? 

A. Ursula would be considered a gray hat since she is performing an act against illegal activities. 

B. She would be considered a suicide hacker. 

C. She would be called a cracker. 

D. Ursula would be considered a black hat. 

View Answer

Q8. Study the log below and identify the scan type. 

tcpdump -vv host 192.168.1.10 

17:34:45.802163 eth0 < 192.168.1.1 > victim: ip-proto-117 0 (ttl 48, id 36166) 

17:34:45.802216 eth0 < 192.168.1.1 > victim: ip-proto-25 0 (ttl 48, id 33796) 

17:34:45.802266 eth0 < 192.168.1.1 > victim: ip-proto-162 0 (ttl 48, id 47066) 

17:34:46.111982 eth0 < 192.168.1.1 > victim: ip-proto-74 0 (ttl 48, id 35585) 

17:34:46.112039 eth0 < 192.168.1.1 > victim: ip-proto-117 0 (ttl 48, id 32834) 

17:34:46.112092 eth0 < 192.168.1.1 > victim: ip-proto-25 0 (ttl 48, id 26292) 

17:34:46.112143 eth0 < 192.168.1.1 > victim: ip-proto-162 0 (ttl 48, id 51058) 

tcpdump -vv -x host 192.168.1.10 

17:35:06.731739 eth0 < 192.168.1.10 > victim: ip-proto-130 0 (ttl 59, id 42060) 4500 0014 a44c 0000 3b82 57b8 c0a8 010a c0a8 0109 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 

A. nmap -sR 192.168.1.10 

B. nmap -sS 192.168.1.10 

C. nmap -sV 192.168.1.10 

D. nmap -sO -T 192.168.1.10 

View Answer

Q9. Bill has successfully executed a buffer overflow against a Windows IIS web server. He has been able to spawn an interactive shell and plans to deface the main web page. He first attempts to use the "echo" command to simply overwrite index.html and remains unsuccessful. He then attempts to delete the page and achieves no progress. Finally, he tries to overwrite it with another page in which also he remains unsuccessful. What is the probable cause of Bill's problem? 

A. You cannot use a buffer overflow to deface a web page 

B. There is a problem with the shell and he needs to run the attack again 

C. The HTML file has permissions of read only 

D. The system is a honeypot 

View Answer

Q10. One of the effective DoS/DDoS countermeasures is 'Throttling'. Which statement correctly defines this term? 

A. Set up routers that access a server with logic to adjust incoming traffic to levels that will be safe for the server to process 

B. Providers can increase the bandwidth on critical connections to prevent them from going down in the event of an attack 

C. Replicating servers that can provide additional failsafe protection 

D. Load balance each server in a multiple-server architecture 

View Answer