lab 5 1. Why is it critical to perform a penetration test on a web application a

Question

lab 5

1. Why is it critical to perform a penetration test on a web application and a web server prior to production implementation?

2. What is a cross-site scripting attack? Explain in your own words.

3. What is a reflective cross-site scripting attack?

4. Based on the tests you performed in this lab, which web application attack is more likely to extract privacy data elements out of a database?

5. If you can monitor when SQL injections are performed on an SQL database, what would you recommend as a security countermeasure to monitor your production SQL databases?

6. Given that Apache and Internet Information Services (IIS) are the two most popular web application servers for Linux and Microsoft® Windows platforms, what would you do to identify known software vulnerabilities and exploits?

7. What can you do to ensure that your organization incorporates penetration testing and web application testing as part of its implementation procedures?

8. What is the purpose of setting the DVWA security level to low before beginning the remaining lab steps?

Explanation / Answer

1. It is critical to perform penetration test on the web application and a web server before the product implementation because it ensures confidentiality and the integrity is maintained . It also makes sure to find any issues like if the application is open to malicious attacks . The customer's information is also protected by penetration test.

2. The cross site scripting attack exploits the cross site scripting vulnerability , it is the SQL injection attack . This type of attack injects the XSS script into web pages viewed by other users. To prevent this type of attacks open source libraries are used.

3. Reflective cross-site scripting attack is a type of non persistent attack , the data stored in the server is not modified , and the response id dynamically generated by web application with the help of non-sanitized data from the client scripts. The client scripts can be Javascript , VB script etc .

4. The SQL injection attack is more likely , because SQL injections enter database with administrator rights . To prevent this type of attack java should be used on websites

Related Questions

Navigate

• Browse (All)
• Browse L
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.