Internet and Web

HTML hyperlinks use the tag with an href attribute. The href attribute specifies the destination URL. Option B lacks the href attribute. Option C uses name instead of href. Option D incorrectly uses 'url' instead of 'href'.

The correct way to create an email link in HTML is using the anchor tag with the mailto: protocol. This tells the browser to open the default email client when the link is clicked.

The target="_blank" attribute in an anchor tag opens the link in a new browser window or tab. This is the standard HTML way to specify that a link should open in a new browsing context. Option B (target="new") is not a valid HTML attribute value.

Interwoven's product portfolio includes TeamSite (WCM), MetaTagger (metadata management), and the discontinued SitePublisher. VCM and VAP are legacy or less-known offerings, while Alfresco is a competing ECM platform. The three correct options represent Interwoven's core and supporting products.

Clickjacking attacks can trick users into granting permission for webcam and microphone access by invisibly layering malicious elements over visible buttons. This social engineering exploit manipulates user interactions without awareness.

The Internet is fundamentally a worldwide system of interconnected computer networks. It is not a collection of software bundles, web pages, or web sites - those are content or applications that run ON the Internet, not the Internet itself. The Internet is the infrastructure that connects these networks together.

A website is a collection of related web pages hosted under a single domain name. Just as a book contains multiple pages, a website contains multiple web pages. Websites do not contain spiders (which crawl them), networks (which host them), or systems in this context.

Visited URLs shows what AppScan actually tested. Broken links reveal URLs AppScan couldn't access (gaps in coverage). Javascripts indicates client-side coverage - modern apps load content dynamically via JS, so seeing what JS was processed helps confirm comprehensive coverage.

WASC (Web Application Security Consortium) was a not-for-profit consortium of international experts, industry practitioners, and organizational representatives that produced open source security standards for the web. OWASP is similar but the description specifically matches WASC.

OWASP stands for Open Web Application Security Project. It is a worldwide non-profit organization focused on improving the security of software. The 'Project' in its name reflects its collaborative, community-driven nature.

CSRF tokens embedded in URLs (or hidden form fields) validate that the request originated from the legitimate application page, not from a malicious third-party site. The token is unpredictable and session-specific, making forged requests invalid. Cross Site Scripting (XSS) is a different vulnerability requiring output encoding. Cross Site Tracing (XST) is a related but distinct attack.

LiveHTTPHeaders is a Firefox browser extension that allows users to view and modify HTTP request and response headers in real-time. As an HTTP tampering tool, it enables security testing by letting users intercept, inspect, and modify HTTP traffic before it reaches the server. Sqlninja, Bobcat, and WebGoat are not Firefox-based HTTP tampering tools - they serve different security testing purposes.

Burp Suite is an interactive HTTP/S proxy server widely used for attacking and testing web applications. It sits between the browser and target server, allowing interception, modification, and analysis of HTTP/S traffic. WebGoat is a vulnerable application for practice, BeEF is for browser exploitation, and Ounce is a static analyzer.

AntiSamy is the OWASP project that provides an API for ensuring user-supplied HTML/CSS content complies with application rules. It sanitizes input to prevent XSS attacks while allowing safe HTML. WebScarab is a proxy tool, WebGoat is a vulnerable app, and ESAPI is a broader security framework.

OWASP WebGoat is a deliberately insecure J2EE web application designed to teach developers about common application security vulnerabilities. It provides hands-on practice with flaws like SQL injection, XSS, and authentication bypass. It's not a proxy or scanner - it's a learning platform.