The rules are simple. This is a TRUE or FALSE quiz, where TRUE = TREAT and FALSE = TRICK.
Good luck…
Question 1
NoSQL technologies can be vulnerable to Injection vulnerabilities.
Correct!
Opps, Wrong!
TRUE - While NoSQL technologies may not suffer from the traditional SQL Injection vulnerabilities, NoSQL Injection vulnerabilities can be exploited by attackers to alter the NoSQL database query to steal data or potentially execute arbitary server-side JavaScript.
Question 2
Running my web application server as the root user is fine if its just hosting static content.
Correct!
Opps, Wrong!
FALSE - Running a web server as a root user is never a good idea, any successful attack against the server could be leveraged for further attacks within your network.
Question 3
The HTTP TRACE method can lead to information disclosure.
Correct!
Opps, Wrong!
TRUE - The HTTP TRACE (and TRACK) method is used for debugging and reflects the input back to the requesting user. If this method is enabled on an application server it could be abused in some scenarios to steal user credentials. Whilst its not really used anymore by modern applications and server, users should ensure that their web server's are not accepting this method.
Question 4
JWT bearer tokens are more secure than session cookies.
Correct!
Opps, Wrong!
FALSE - JSON Web Token does not have any security based advantage over cookie based sessions. JWTs provide a means of maintaining session state on the client instead of doing it on the server. JWT's are just like session cookies and are as secure as the web developer who implemented them.
Question 5
Adding the "X-XSS-Protection" header to the HTTP headers returned by my web server will protect me from XSS attacks.
Correct!
Opps, Wrong!
FALSE - the X-XSS-Protection header is no longer supported by modern browsers and can no longer be relied on to fully protect against XSS attacks. When it was supported a number of bypass’s were possible. Prevention of cross-site scripting involves a defence in depth approach which will employ the use input and output encoding and a robust CSP policy.