Web Application Security Fundamentals

This scenario is a classic example of Broken Authentication and Session Management - the user failed to properly terminate their session (logout), allowing an attacker to hijack the authenticated session. The vulnerability is that session identifiers remained valid and accessible, enabling the attacker to impersonate the legitimate user without re-authenticating. This differs from authorization issues (A), security misconfiguration (C), or CSRF (D).

Exposing session IDs or authentication credentials in URLs (B) is a valid scenario of Broken Authentication and Session Management. URLs get logged in browser history, server logs, and referrer headers - exposing sensitive authentication data in URLs allows attackers to capture session identifiers. Option (A) describes an authorization issue, (C) is about data exposure, and (B) is the correct authentication/session management vulnerability.

Insecure Direct Object References occur when an application exposes internal object references (like database keys, file paths, or directory entries) without proper access control validation. Option (B) 'Unauthorised access to any webpage/webdata directly or indirectly' describes this - attackers manipulate direct object references to access unauthorized data. Option (A) relates to injection, (C) is about patching, and (B) correctly describes IDOR.

Using per-user or session indirect object references (like using database IDs instead of sequential numbers) prevents Insecure Direct Object References. Without this, attackers can manipulate URLs or parameters to access other users' data by guessing or incrementing IDs. This ensures users can only access objects they're authorized to see.

Cross Site Request Forgery (CSRF) involves attackers forging authenticated requests that victims unknowingly submit. Since the browser automatically sends cookies (including session tokens) with the request, the server believes it's from the legitimate user. Key indicators: forged requests, tricking victims, authentication bypass. Unlike XSS which executes scripts in the browser.

CSRF tokens are unique, unpredictable values included in forms as hidden fields. When the form is submitted, the server validates this token matches the session token. Since attackers cannot guess or obtain this token, they cannot forge valid requests even if they trick users into submitting forms. This is the primary defense against CSRF.

Exception stack traces exposed to users reveal internal system details: file paths, database schemas, software versions, and potential vulnerabilities. Attackers use this information for targeted attacks. This is a clear case of Security Misconfiguration (specifically, Weak Security Configuration). Proper error handling should show generic messages to users.

Security Misconfiguration includes leaving default configurations unchanged: default admin accounts, default passwords, demo pages, or unused services installed. Attackers know these defaults and use them to gain unauthorized access. The scenario describes exactly this - default admin console with default credentials unchanged.

Using strong hashing algorithms with salts prevents Insecure Cryptographic Storage. Salting adds uniqueness to each password, preventing rainbow table attacks. Strong hashing (bcrypt, scrypt, Argon2) resists brute-force attacks. Without these, stolen password databases can be easily cracked, leading to credential theft.

This is a classic Insecure Cryptographic Storage scenario. Encrypting data is useless if the decryption key is stored alongside the encrypted data. When the backup tape is stolen, the attacker has both the encrypted data and the key to decrypt it. Keys must be stored separately, preferably in a secure key management system.

Failure to Restrict URL Access happens when applications don't verify authorization for every page request. Attackers can simply guess or manipulate URLs (like /admin, /user/profile/123) to access privileged functionality. The scenario describes this exactly - an authorized user changes URL to access unprotected privileged pages.

The deny-by-default approach prevents Failure to Restrict URL Access by ensuring no page is accessible without explicit authorization. This is a defense-in-depth strategy where developers must explicitly grant access rather than accidentally leave pages unprotected. It prevents attackers from accessing unprotected pages through URL manipulation.

Not using SSL for authenticated pages allows attackers on the network to intercept session cookies (sniffing). Requiring SSL for all sensitive pages encrypts traffic, preventing cookie theft. The scenario describes Insufficient Transport Layer Protection. Requiring SSL and redirecting non-SSL requests is the correct defense.

Using mapping values instead of actual URLs prevents Unvalidated Redirects and Forwards. Instead of redirecting to user-supplied URLs, the application uses those values as keys to look up allowed destinations. This prevents attackers from crafting malicious redirect URLs to phishing sites. The mapping acts as a whitelist.

Io, a moon of Jupiter, is the most volcanically active body in the solar system due to intense tidal heating from Jupiter's gravitational forces. It has hundreds of active volcanoes that constantly resurface the moon with sulfur and silicate lava.

Ganymede, a moon of Jupiter, is the largest moon in the solar system with a diameter of 5,268 km. It is even larger than the planet Mercury and has its own magnetic field.