Karteikarten
Security
Karten in diesem Stapel (19)
- 1What is SQL injection?When someone maliciously inserts an SQL statement into your website using your websites forms.
- 2How do you secure your website from SQL injection?Sanitize input from users.
Strip Suspect words such as DELETE INSERT ... - 3What is XSS?Cross Site Scripting. This is when a hacker inserts script into a input box on the site that will be seen by other users. This is typically html or javascript that will infect all users with a virus.
- 4How do you secure your website from XSS?Check all input from users not allowing < or > or 'script' or quotes. Anything that will allow code to be run.
strip_tags() - is a php function that removes all html tags - 5how do you check for extra variables that may have been inserted into a input box?Count the number of variables that are expected and put them in an array and compare with the actual submitted by the form. Don't allow to submit if their are more fields.
- 6Why should you hide errors from the user?Errors provide information about your database or your site that may give a hacker information that you don't want them to have, such as variable names.
- 7How do you hide errors from the user?Make a customer error page and if an error occurs send the user to that page instead of displaying the error.
- 8How should you secure you file system?Only allow certain IP addresses to access the development.
Remove notes from the production server.
Store sensitive files outside the web root. - 9How do you make file upload secure?Don not allow the user to select the directory to upload to. This will ensure that people can not directly access files.
Change the names of uploaded files. This will mean that malicious files can not be found by name on the server by the hacker.
If possible, check the file type. This will ensure that no malicious files are uploaded - 10what is isImageFile()?Should be used when checking the file type of files that are uploaded to the server.
- 11What steps should you take to secure your database?Make the tables read-only.
Set roles for users and restrict their rights.
Disable CREATE, DROP GRANT, REVOKE and ALTER if they are not needed.
Monitor traffic with IP addresses, recording what every user does.
Restrict the amount of data that is displayed. - 12How should you authenticate a user that is trying to access the database?WHen logging in check authentication.
When trying to do a high level task, refresh authentication.
Reduce role if the user goes to complete a lower level task and re-authenticate of they try and complete a high one again. - 13How should you secure your DSN?Only allow a SELECT connection if that is all you need.
- 14What are the two main types of encryption?MD5
sha256 - 15Explain how the sha256 algorithm works.The password is entered into a text field, the password is then passed though the algothithm and the cithertext is stored in the database.
The same password will produce the same cithertext - 16What is the php code for implementing sha256?$cithertext = hash('sha256', $input);
- 17What is the coldfusion code for sha256?
- 18What is salt?Salt is a random selection of characters that will be placed in the algorithm that will mean the cithertext will differ even though the initial password is the same.
- 19What is GetAuthUser() used for?It s a coldfusion function that gets the name of the authenticated user.
It checks for a login made with cfloginuser.
It stops user needing to log in on a secure network such as a university.
Informationen
- Beschreibung
- Degree Server Side Scripting Karteikarten am Security , erstellt von elbruce am 11/04/2014.
- Erstellt von
- elbruce
- Aufrufe
- 26
- Bewertung