Tag: general knowledge

The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker derives the standard admin pages are on your server, logs in with default passwords, and start playing with the website. This is the kind of Web security risk :

Passwords are hashed with a strong standard algorithm and an appropriate salt is used. Using such a mechanism, we are introducing a security to avoid :

A backup tape is made of encrypted health records, but the encryption key is on the same backup. This scenario comes under the risk of :

Attacker, who is an authorized system user, simply changes the URL to a privileged unprotected page and gets the access of it. This happened due to :

The enforcement mechanism should deny all access by default, requiring explicit grants to specific users and roles for access to every page. This is done to prevent from :

A site simply doesn’t use SSL for all pages that require authentication. and observes an authenticated victim’s session cookie. Attacker then replays this cookie and takes over the user’s session. To prevent this kind of attacks, which of the following can be an effective methodogy:

It is recommended that any request parameter by which destination page is to be derived be a mapping value, rather than the actual URL or portion of the URL. This can prevent from: