NetSPI Interview

parameterized queries and prepared statements

IDOR is an access control flaw where the server returns or modfies an object based on a user-supplied ID without checking whether the requester is authorized for that abject

UUIDs only make object IDs harder to guess, but they still leak through responses, links, and logs, and the server still never checks whether the requester is authorized to access the object

Universally Unique Identifiers are used to label objects so that IDs are hard to guess. Attackers can still get them from API responses, Shared links, Frontend code

Perform a lookup scoped only to documents owned by the current user.

Perform access control checks on every object the user attempts to access and provide defense in depth by implementing unpredictable UUID's instead of numeric keys

It's a nonprofit foundation that develops freely available sources, testing guides, and best practices for improving application security

Pen testers use OWASP resources to guide testing, udnerstand vulnerability categories and communicate remediation guidance

Injection Vulnerability where application handles untrusted user input unsafely, allowing attacker-controlled Javascript to execute in a user's browser

Reflected: The server echoes malicious input from the request straight back into the response, so it runs once for whoever sends that request. It is usually sent via a crafted link the victim clicks, like phishing email or social media post

The malcious input is saved by the server and served to anyone who views the page
It is usually served through comment sections, user profile details, contact forms, message boards

Client Side Javascript takes attacker controlled data from a source and writes it into a dangerous sink
It is usually delivered via. crafted link

DOM XSS never touches or passes through the web server

Identify input sources, inspect where the input appears in the page or DOM, test context specific payloads.

A browser security mechanism that mitigates XSS by restricting the resources (JSS, images, CSS) that a browser is allowed to load and execute

It converts special characters in untrusted data into safe representations so the browsers HTML parser treats them as text rather than HTML syntax

outpiut encoding, input validation, HTML sanitization, Content Security Policy, HttpOnly cookies

Cross-Site Request Forgery: an attacker tricks an authenticated user's browser into executing an unwanted, state-changing action on a untrsuted web app

A relevant action has to be performed, the app identfiies the user by cookies only so the browser sends it automatically, there are no unpredictable parameters added

CSRF tokens, SameSite Cookies, Referer Based Validation