Internet and Web

Visited URLs shows what AppScan actually tested. Broken links reveal URLs AppScan couldn't access (gaps in coverage). Javascripts indicates client-side coverage - modern apps load content dynamically via JS, so seeing what JS was processed helps confirm comprehensive coverage.

WASC (Web Application Security Consortium) was a not-for-profit consortium of international experts, industry practitioners, and organizational representatives that produced open source security standards for the web. OWASP is similar but the description specifically matches WASC.

OWASP stands for Open Web Application Security Project. It is a worldwide non-profit organization focused on improving the security of software. The 'Project' in its name reflects its collaborative, community-driven nature.

CSRF tokens embedded in URLs (or hidden form fields) validate that the request originated from the legitimate application page, not from a malicious third-party site. The token is unpredictable and session-specific, making forged requests invalid. Cross Site Scripting (XSS) is a different vulnerability requiring output encoding. Cross Site Tracing (XST) is a related but distinct attack.

LiveHTTPHeaders is a Firefox browser extension that allows users to view and modify HTTP request and response headers in real-time. As an HTTP tampering tool, it enables security testing by letting users intercept, inspect, and modify HTTP traffic before it reaches the server. Sqlninja, Bobcat, and WebGoat are not Firefox-based HTTP tampering tools - they serve different security testing purposes.

Burp Suite is an interactive HTTP/S proxy server widely used for attacking and testing web applications. It sits between the browser and target server, allowing interception, modification, and analysis of HTTP/S traffic. WebGoat is a vulnerable application for practice, BeEF is for browser exploitation, and Ounce is a static analyzer.

AntiSamy is the OWASP project that provides an API for ensuring user-supplied HTML/CSS content complies with application rules. It sanitizes input to prevent XSS attacks while allowing safe HTML. WebScarab is a proxy tool, WebGoat is a vulnerable app, and ESAPI is a broader security framework.

OWASP WebGoat is a deliberately insecure J2EE web application designed to teach developers about common application security vulnerabilities. It provides hands-on practice with flaws like SQL injection, XSS, and authentication bypass. It's not a proxy or scanner - it's a learning platform.

All HTTP headers and cookies can be manipulated by users and attackers, making them untrusted input that requires validation. Host headers can be used for cache poisoning attacks. Cookies can contain malicious data. Referrer headers are user-supplied. The secure approach is to validate ALL external input, assuming none can be trusted.

In a GET request, the query string (the part after '?' in the URL) is logged by web servers. This is standard behavior for access logs. Hidden tags (A) are in HTML forms, not URLs. Headers (C) and cookies (D) are sent in the HTTP request but are not part of the URL itself, though servers can optionally log them. The query string is always visible in server logs by default.

Forceful browsing (or directory traversal) attacks are prevented by checking authorization on every page request. Obscure file names or directory structure are security through obscurity and not real protection - authorization checks are mandatory.

SIP addresses use the same format as email addresses: user@domain (e.g., sip:[email protected]). This format identifies a user and their registration server, similar to how email addresses identify a user and their mail server.

Google Street View provides panoramic, 360-degree views of streets and locations worldwide, enabling virtual exploration of places. Earth View refers to satellite imagery, while Zoom In/Out are basic navigation controls. Street View specifically enables the immersive virtual visiting experience described.

An email address follows the format local-part@domain-name where the part before @ identifies the specific mailbox (local part) and the part after @ identifies the mail server (domain name). Option A reverses this order incorrectly.

All the listed phenomena threaten email usefulness. Spamming floods inboxes with unsolicited messages, phishing tricks users into revealing sensitive information, email worms spread malicious software, and email bombardment overwhelms systems with excessive traffic.