Application threat modeling Quiz - 1

To develop an application that includes both secured and non-secured web pages, it is important to have the login page SSL (Secure Sockets Layer) enabled in order to protect sensitive user information. The SSL protocol is used to establish a secure and encrypted connection between the user's web browser and the web server.

Now, let's go through each option and explain why it is right or wrong:

A. MITM proxy can be used to change the URL to a non-secured one - This option is a possible security vulnerability. A Man-in-the-Middle (MITM) attack can be used to intercept the user's traffic and redirect them to a non-secured URL. However, enabling SSL on the login page does not directly mitigate this threat.

B. If the login page is not SSL enabled, the credentials will be transmitted in plain text to the web server and Attacker can sniff the credentials supplied by the user - This option is correct. If the login page is not SSL enabled, the credentials supplied by the user will be transmitted in plain text, which can be sniffed by attackers. This can lead to sensitive information such as usernames and passwords being compromised.

C. Firewall logs will have the credentials in plain text - This option is incorrect. Enabling SSL on the login page does not directly affect the firewall logs. Firewall logs can capture network traffic, including login credentials, regardless of whether SSL is enabled or not.

D. Proxy logs will have the credentials in plain text - This option is also correct. If SSL is not enabled on the login page, the credentials supplied by the user will be transmitted in plain text, which can be captured by proxies. This can lead to sensitive information such as usernames and passwords being compromised.

Therefore, the correct answer is:

The Answer is: B. If the login page is not SSL enabled, the credentials will be transmitted in plain text to the web server and attacker can sniff the credentials supplied by the user.

To ensure application security during multi-staged login in an application, the developer should ensure that the credentials supplied at each stage are validated before moving to the next stage.

Option A states that the application should validate the credentials supplied at each stage only. This option is partially correct. Validation of credentials at each stage is necessary, but validating only at each stage is not enough. It is important to validate the credentials of previous stages as well to ensure security.

Option B suggests that hidden variables should be used to remember the previous stage values and current stage supplier credentials to be validated at the server end. Hidden variables can be used to store data, but they do not guarantee security. Attackers can access and modify hidden variables, which can lead to security vulnerabilities.

Option C is the correct answer. During multi-staged login, the application should validate the credentials supplied at each stage and previous stages. This ensures that all supplied credentials are correct and valid before allowing access to the application.

Option D suggests that credentials supplied at the previous stage should be saved in a cookie and current stage supplier credentials to be validated at the server end. Saving credentials in cookies can also lead to security vulnerabilities as attackers can access and modify cookies.

Therefore, the correct answer is:

The Answer is: C. During multi-staged login, the application should validate the credentials supplied at each stage and previous stages.

Cross-Site Scripting (XSS) attacks work by injecting malicious scripts into web pages that other users view. When a vulnerable site echoes client-supplied data without proper sanitization, that data executes in the context of the victim's browser session, allowing attackers to steal cookies, session tokens, or perform actions on behalf of the victim.

Remote File Inclusion (RFI) is an attack that exploits web applications that dynamically include external files based on user input without proper validation. Attackers manipulate file inclusion parameters to include malicious files from remote servers, leading to code execution, data theft, or server compromise.

Static code analysis examines source code for defects, security vulnerabilities, and coding standard violations without executing the program. This is distinct from dynamic analysis, which requires running the application. Static analysis tools parse code, build abstract syntax trees, and apply rules to identify potential issues at compile time.

Virtual patching involves implementing a security policy or control at the network or host level to block exploit attempts on vulnerabilities without modifying the application code itself. Other options like anti patching, anti attack, or patch attack are incorrect distractors.

AppSensor provides a framework and toolset for instrumenting applications to detect and respond to attacks in real-time, acting as an application-based intrusion detection system. It is not a WAF, database monitor, or virtual private LAN.

ModSecurity is an open-source web application firewall (WAF) designed to detect and block threats targeting web applications. The other options are incorrect because it is not an application intrusion detection system, database monitor, or VPN/VLAN solution.

Side-channel attacks exploit physical information leaked by the cryptographic system, such as power consumption, electromagnetic radiation, or execution timing. Other choices like Back, Unknown, or Reverse attacks are not standard terms for physical implementation exploits.

A Database Activity Monitor (DAM) is designed to monitor, log, and analyze database transactions for compliance and security (such as privileged user and application activity monitoring, and cyberattack protection). Database recovery is a function of database backup/restore systems and DBMS engines, not a DAM tool.

DREAD is a computer security threat classification and risk assessment model. It evaluates threats based on five categories: Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. FEAR, SAFE, and DEAF are distractors and not standard security classification models.

STRIDE is a widely recognized threat modeling methodology developed by Microsoft. It helps identify security threats across six categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. PRIDE, BRIDE, and RIDE are distractors.

To solve this question, the user needs to understand the concept of security vulnerabilities related to web applications.

The correct answer is A. HTTP Parameter Pollution.

Explanation:

HTTP Parameter Pollution (HPP) is a security vulnerability that arises when an attacker submits multiple input parameters of the same name to a web application. This can lead to unexpected behaviors on the server-side and client-side, which can then be exploited by attackers to achieve their goals.

Option B, Session Splitting, is not related to the given premise. Session Splitting is a technique used to distribute user sessions across multiple servers to improve performance and scalability.

Option C, Parameter Damage, is not a commonly used term in the field of web application security. It is not related to the given premise.

Option D, Parameter Busting, is not a commonly used term in the field of web application security. It is not related to the given premise.

Therefore, the correct answer is:

The Answer is: A. HTTP Parameter Pollution.

An Evercookie is a JavaScript-based API that produces extremely persistent cookies in a browser. It achieves this by storing cookie data in several redundant storage mechanisms (such as Local Storage, IndexedDB, Flash Cookies, Silverlight, and browser cache) and recreating deleted cookies from surviving copies.

A Padding Oracle Attack is a well-known cryptographic exploit against block cipher modes of operation (such as CBC mode) that leak information about whether the padding of a decrypted ciphertext is valid. The other options are incorrect or fabricated terms rather than established cryptographic attacks.

Functions like strcpy, strcat, strncpy, sprintf (mistyped in prompt as sprint), and gets do not perform safe bounds-checking on buffers, making them highly vulnerable to buffer overflow attacks. Consequently, security standards and modern development guidelines classify them as banned APIs.

FxCop is Microsoft's free static code analysis tool for .NET managed code. It analyzes assemblies for compliance with Microsoft's .NET Framework Design Guidelines, checking for naming conventions, library design, performance, security, and other best practices. It helps developers identify potential issues before deployment.

OllyDbg is a well-known 32-bit assembler-level analyzing debugger for Microsoft Windows. It is widely used in reverse engineering, malware analysis, and software cracking because it allows binary code analysis, modification, and debugging without access to the source code.

A NOP sled (or NOP slide) is a classic technique used in buffer overflow attacks to execute arbitrary shellcode. It consists of a sequence of NOP (no-operation) instructions placed before the shellcode, allowing the execution flow to safely slide into the payload even if the instruction pointer is redirected to an imprecise address.