Information Security

All these vulnerabilities share a root cause: insufficient validation or sanitization of untrusted input. When user input is not properly validated before use, attackers can manipulate it to trigger buffer overflows, inject malicious scripts or SQL commands, or exploit format string vulnerabilities.

Secure configuration management is essential for all types of applications - commercial off-the-shelf software, custom-built applications, and in-house developments. All software requires proper hardening, patching, and secure configuration.

In asymmetric cryptography, the public key is designed to be shared freely without compromising security. It can only be used to encrypt data or verify signatures - decryption requires the private key which must be kept secret. Encrypted data, private keys, and symmetric keys must all be protected.

Data validation ensures that user input conforms to expected formats before being used in database queries, making it harder for attackers to inject malicious SQL code. Secure cookies, encryption, and exception handling are important security measures but they don't directly prevent SQL injection attacks. SQL injection specifically exploits unvalidated input concatenated into SQL statements.

Cookies should only contain a session identifier that references server-side session data. Storing sensitive information like passwords or account privileges in cookies exposes them to theft and manipulation. Usernames in cookies can also be used for session hijacking and should be avoided - the session ID alone is sufficient.

Hashing creates a fixed-size digital fingerprint that uniquely represents data. If even a single bit changes, the hash will be completely different, making it an excellent mechanism for detecting data tampering. Session validity and user authentication require different mechanisms like expiration tokens and credential verification.

CR (carriage return, %0D or %00 in some encodings) and LF (line feed, %0A) are line break characters used to separate HTTP headers. Attackers inject these characters into input to split the HTTP response and inject arbitrary headers or even content. This is the signature of HTTP Response Splitting (also called CRLF injection).

Forced browsing (or path traversal) attacks succeed when the application fails to check if a user is authorized to access a specific URL or resource. The attacker guesses or enumerates URLs and accesses them directly without proper permission checks. This is fundamentally an authorization failure - the application authenticated the user but didn't verify their right to access that specific resource.

Administrative pages offer highly privileged access and must be protected with strong multi-factor (2/3 factor) authentication to secure them against credential harvesting. Simple single-factor passwords, basic HTTP authentication, or disabling account lockouts introduce severe vulnerabilities, leaving administrative interfaces exposed to brute-force and credential stuffing attacks.

Detailed error messages like stack traces should be logged securely on the server for debugging, while users receive generic error messages. Storing sensitive debugging info in hidden fields (option A) exposes it to anyone viewing the page source. Simply destroying the information (option B) loses valuable debugging data needed to fix the underlying problem.

A backdoor is a hidden method that bypasses normal authentication to gain unauthorized access. Option C correctly defines it as a security loophole using secret tokens or identifiers. Options A, B, and D describe legitimate features or connections, not security bypass mechanisms.

Hardcoded credentials that bypass normal authentication are a backdoor because they provide secret access without legitimate credentials. This is different from access control vulnerabilities (B) which are flaws in permission logic. Buffer overflow (C) and SQL injection (D) are completely different vulnerability types involving memory corruption and query manipulation.

Web servers ship with default settings optimized for ease of use, not security. They often have unnecessary services enabled, default credentials, or verbose error messages. Options A, B, and C are incorrect because servers require deliberate hardening after installation to be secure.

Client-side validation can be bypassed by manipulating requests or disabling JavaScript. Security controls must enforce rules on the server where attackers cannot tamper with them. Options A (default-deny filtering), B (least privilege), and D (stored procedures) are valid security practices.

Phishing is social engineering that tricks users into performing actions like clicking malicious links or entering credentials. It targets human behavior, not technical vulnerabilities. Options A and C describe technical exploitation, while D is unrelated to phishing success.