Tag: security

Attackers can use error messages to extract specific information from a system.

Attackers can use unexpected errors to knock an application off line, creating a denial-of-service attack

Attackers can use revealed error messages to craft more advance attacks to gain system access

All of the above

Cross site scripting

Command injection

Path traversal attacks

Buffer overflow

Insecure file upload

Path Traversal

Brute forcing

Universal PDF XSS

True

False

May be

Never

To prevent scripted attach

to provide biometric authentication

to check the color blindness of user

more security

compliance testing

functional testing

unit testing

black box testing

After system testing and application security testing but before deployment to production

After application security testing but before acceptance test by the client/end user

just before deployment to production

after system test

After integration testing but before acceptance testing by the client/end user

after unit test

after integration testing

during system testing

STRIDE

DREAD

OWASP

DAR

Risk score = (Reproducibility * Exploitability * Discoverability) / (Damage potential * Affected users)

Risk score = (Reproducibility * Exploitability - Discoverability) ^ (Damage potential + Affected users)

Risk score = (Reproducibility + Exploitability + Discoverability) / (Damage potential + Affected users)

Risk score = (Reproducibility + Exploitability + Discoverability) * (Damage potential + Affected users)