Deck 10: Hacking Web Servers

Question 1

CGI programs can be written in many different programming and scripting languages, such as C/C++, Perl, UNIX shells, Visual Basic, and FORTRAN.

Answer 1

True

Question 2

All CFML tags begin with "____".

A)?
B)CF
C)CFML
D)%

Answer 2

B

Question 3

Connecting to a Microsoft Active Directory Service database with OLE DB requires using ____ as the provider.

A)ADSDSOOBJECT
B)MySQLProv
C)SQLOLEDB
D)SNAOLEDB

Answer 3

A

Question 4

____ is the interface that describes how a Web server passes data to a Web browser.

A)Perl
B)ASP
C)CGI
D)PHP

Question 5

____ is a standard database access method developed by the SQLAccess Group.

A)OLE DB
B)ODBC
C)ADO
D)JDBC

Question 6

____ was originally used primarily on UNIX systems, but is used more widely now on many platforms, such as Macintosh and Windows.

A)HTML
B)JScript
C)VBScript
D)PHP

Question 7

Web applications written in CFML can also contain other client-side technologies, such as HTML and JavaScript.

Question 8

ColdFusion uses its own proprietary tags written in ____.

A)XML
B)DHTML
C)PHP
D)CFML

Question 9

The column tag in CFML is ____.

A)
B)
C)<%COL>
D)

Question 10

The ____ Search page is an excellent starting point when investigating VBScript vulnerabilities.

A)CVE Web site
B)CERT
C)Microsoft Security Bulletin
D)Macromedia security

Question 11

A user can view the source code of a PHP file by using the browser's "View Source" option.

Question 12

____, developed by Microsoft, is a set of interfaces that enable applications to access data stored in a database management system.

A)OLE DB
B)ODBC
C)ADO
D)JDBC

Question 13

Visual Basic Script (VBScript) is a scripting language developed by ____.

A)Sun Microsystems
B)Symantec
C)Macromedia
D)Microsoft

Question 14

OLE DB relies on connection strings that enable the application to access the data stored on an external device.

Question 15

Web servers use the ____ element in an HTML document to allow customers to submit information to the Web server.

A)
B)
C)
D)

Question 16

The JavaScript getElementByld() function is a method defined by the ____ Document Object Model (DOM).

A)W3C
B)IETF
C)Internet Society
D)IEEE

Question 17

To check whether a CGI program works, you should save the program to the ____ directory of your Web server, and then enter the URL in your Web browser.

A)bin
B)cgi-bin
C)cgi
D)scripts

Question 18

Connecting to an MS SQL Server database with OLE DB requires using ____ as the provider.

A)ADSDSOOBJECT
B)MySQLProv
C)SQLOLEDB
D)SNAOLEDB

Question 19

JavaScript is a server-side scripting language that is embedded in an HTML Web page.

Question 20

Connecting to a MySQL database with OLE DB requires using ____ as the provider.

A)ADSDSOOBJECT
B)MySQLProv
C)SQLOLEDB
D)SNAOLEDB

Question 21

In Windows, IIS stands for ______________________________.

Question 22

MATCHING
Match each term with the correct statement below.
a.WebGoat
f.Wfetch
b.HTML
g.JScript
c.CGI
h.virtual directory
d.Cgi Scanner v1.4
i.XSS
e.Apache
helps beginning Web application security testers gain a better understanding of the areas covered in the OWASP top ten Web applications vulnerability list

Question 23

SQL ____ involves the attacker supplying SQL commands when prompted to fill in a Web application field.

A)redirection
B)spoofing
C)injection
D)insertion

Question 24

MATCHING
Match each term with the correct statement below.
a.WebGoat
f.Wfetch
b.HTML
g.JScript
c.CGI
h.virtual directory
d.Cgi Scanner v1.4
i.XSS
e.Apache
language developed by Microsoft

Question 25

In a(n) ____ flaw, a Web browser might carry out code sent from a Web site.

A)broken access control
B)command injection
C)cross-site scripting
D)unvalidated parameters

Question 26

Connecting to a VSAM database with OLE DB requires using ____ as the provider.

A)ADSDSOOBJECT
B)MySQLProv
C)SQLOLEDB
D)SNAOLEDB

Question 27

CFML stands for ______________________________.

Question 28

____ represent(s) a comment in SQL.

A)Double slashes (//)
B)An exclamation point (!)
C)An asterisk (*)
D)Double hyphens (--)

Question 29

MATCHING
Match each term with the correct statement below.
a.WebGoat
f.Wfetch
b.HTML
g.JScript
c.CGI
h.virtual directory
d.Cgi Scanner v1.4
i.XSS
e.Apache
a Web server

Question 30

____ is one of the best tools for scanning the Web for systems with CGI vulnerabilities.

A)Cgiscan.c
B)WebGoat
C)Wfetch
D)Phfscan.c

Question 31

MATCHING
Match each term with the correct statement below.
a.WebGoat
f.Wfetch
b.HTML
g.JScript
c.CGI
h.virtual directory
d.Cgi Scanner v1.4
i.XSS
e.Apache
tool for searching Web sites for CGI scripts that can be exploited

Question 32

One of the best Web sites to find tools for hacking Web applications is ____.

A)http://www.cert.org
B)http://www.owasp.org
C)http://www.cve.mitre.org
D)http://packetstormsecurity.org

Question 33

MATCHING
Match each term with the correct statement below.
a.WebGoat
f.Wfetch
b.HTML
g.JScript
c.CGI
h.virtual directory
d.Cgi Scanner v1.4
i.XSS
e.Apache
GUI tool that can be downloaded free from Microsoft and is included in the IIS Resource Kit

Question 34

MATCHING
Match each term with the correct statement below.
a.WebGoat
f.Wfetch
b.HTML
g.JScript
c.CGI
h.virtual directory
d.Cgi Scanner v1.4
i.XSS
e.Apache
foundation of most Web applications

Question 35

____________________ Web pages display the same information regardless of the time of day or the user who activates the page.

Question 36

MATCHING
Match each term with the correct statement below.
a.WebGoat
f.Wfetch
b.HTML
g.JScript
c.CGI
h.virtual directory
d.Cgi Scanner v1.4
i.XSS
e.Apache
main role is passing data between a Web server and Web browser

Question 37

MATCHING
Match each term with the correct statement below.
a.WebGoat
f.Wfetch
b.HTML
g.JScript
c.CGI
h.virtual directory
d.Cgi Scanner v1.4
i.XSS
e.Apache
stands for cross-site scripting flaw

Question 38

____________________ Web pages can vary the information that's displayed depending on variables such as the current time and date, user name, and purchasing history (information collected via cookies or Web bugs).

Question 39

MATCHING
Match each term with the correct statement below.
a.WebGoat
f.Wfetch
b.HTML
g.JScript
c.CGI
h.virtual directory
d.Cgi Scanner v1.4
i.XSS
e.Apache
keeps attackers from knowing the directory structure on an IIS Web server

Question 40

To keep attackers from knowing the directory structure you create on an IIS Web server, creating a(n) ____________________ is recommended so that the path a user sees on the Web browser is not the actual path on the Web server.

Question 41

What is JavaScript?

Question 42

What is OWASP?

Question 43

What is ODBC used for?

Question 44

What is ActiveX Data Objects (ADO)?

Question 45

As a security professional, what should you do after identifying that a Web server you are testing is using PHP?

Question 46

What is ColdFusion?

Question 47

Why should security professionals have at least a little knowledge about the Apache Web Server?

Question 48

Dynamic Web pages need special components for displaying information that changes depending on user input or information obtained from a back-end server. What kind of components can Web pages use to achieve this?

Question 49

What is VBScript?

Question 50

What features does the current version of Wfetch offer?

Question 51

What can an attacker do after gaining control of a Web server?

Question 52

What is the main difference between HTML pages and Active Server Pages (ASP)?