8.4

You want to prevent your browser from running JavaScript commands that are potentially harmful. Which of the following would you restrict to accomplish this?

A programmer that fails to check the length of input before processing leaves his code vulnerable to what form of common attack?

Which of the following is an attack that injects malicious scripts into Web pages to redirect users to fake websites or gather personal information?

When you browse to a website, a pop-up tells you that your computers has been infected with a virus. You click on the window to see what the problem is. Later, you find out that the window has installed spyware on your system. What type of attack has occurred?

Which of the following are subject to SQL injection attacks?

You have a website that accepts input from users for creating customer accounts. Input on the form is passed to a database server where the user account information is stored. An attacker is able to insert database commands in the input fields and have those commands execute on the server. Which type of attack has occurred?

Having poor software development practices and failing to program input validation checks during development of custom software can result in a system vulnerable to which type of attack?

Which type of attack is the act of exploiting a software program's fee acceptance of input in order to execute arbitrary code on a target?

As you browse the internet, you notice that when you go to some sites, multiple additional windows are opened automatically. Many of these windows contain advertisments for products that are inappropriate for your family to view. Which tool can you implement to prevent these windows from showing?

While using a Web-based order form, an attacker enters an unusually large value in the Quantity field. The value she entered is so large that it exceeds the maximum value supported by the variable type used to store the quantity in the Web application. This causes the value of the quantity variable to wrap around the minimum possible value, which is a negative number. As a result, the web application processes the order as a return instead of a purchase, and the attacker's account is refunded a large sum of money. What type of attack has occurred in this scenario?

While using a web-based game created using Adobe Flash, a flash cookie is set on a user's computer. The game saves legitament data in the flash cookies such as statistics and user preferences. However, the game creator also programmed the game to track the Web sites that the user visits while the game is running and save them in the flash cookie. The data is transferred to a server over an internet connection without the user's permission. What type of exploit has occurred in this scenario?

Recently a web site named www.vidshare.com has become extremely popular with users around the world. An attacker registers the following domain names: www.videoshare.com www.vidshar.com www.vidsshare.com Each of these URLs points to a phishing web site that tricks users into supplying their vidshare.com user names and passwords. What type of attack has occurred in this scenario?

watering hole attack

Arbitrary code execution exploit

LSO exploit

Zero-day attack

An attacker inserts SQL database commands into a data input field of an order form used by a WbBased application. When submitted, these commands are executed on the remote database server, causing customer contact information from the database to be sent to the malicious user's web browser. Which practice would have prevented this exploit?

While using a web based order form, an attacker enters an unusally large value in the quantity field. The value she entered is so large that it exceeds the maximum value supported by the variable type used to store the quantity in the web application. This causes the value of the quantity variable to wrap around to the minimum possible value which is a negative number. As a result, the web application processes the order as a return instead of a purchase, and the attacker's account is credited with a large sum of money. Which practieces would have prevented this exploit?