How Much do You Know About AppSec?
The Ultimate AppSec Trivia Challenge is a fun and educational game that tests your application security knowledge. The game consists of questions ranging from easy to hard, all related to application security.
Level: Easy
Injection vulnerabilities have been in the OWASP Top 10 since its creation.
Level: Easy
In 2023 OWASP changed its name from Open Web Application Security Project, to make it more inclusive to the different aspects of application security.
Level: Easy
The noscript tag prevents the script tag from being interpreted.
Windows XP support ended in 2014.
Various industry guidelines and standards, such as OWASP ASVS, OWASP Top 10, and NIST 800-63b consider this an insecure design.
These are the first names of the three creators of the widely used RSA cryptographic algorithm
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
RSA: The 1st part is the key exchange algorithm, 2nd, the authentication, 3rd encryption, and 4th is the MAC.
HTTP/1.1 200 OK
date: Thu, 06 Apr 2023 21:53:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: origin,accept-encoding
content-type: application/json; charset=utf-8
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
<html><body><h1>Hello <script>alert(13)</script></h1></body></html>
No, because the content-type is application/json, which will not be rendered by the browser.
Privileges Required: It can have three values: None, Low or High
GET /?error=foobar%0d%0aSet-Cookie:+sessionid=abcdef
host: example.com
HTTP/1.1 301 Moved Permanently
Location: /index?error=foobar
Set-Cookie: sessionid=abcdef
${T(java.lang.System).getenv()}
Software Bill of Materials. SBOM’s are an inventory of all the components of a given software.
Cookies newer than 2 minutes, can be sent on requests cross-domain, just like in a SameSite=None scenario. After 2 minutes, the Lax configuration is applied.
GET /?name=<script>alert(13)<%2Fscript> HTTP/1.1
host: example.com
HTTP/1.1 200 OK
date: Thu, 06 Apr 2023 21:53:38 GMT
content-security-policy: default-src js.example.com;
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
referer: example.com/?name=<script>alert(13)<%2Fscript>
<html><body><h1>Hello <script>alert(13)</script></h1></body></html>
Answer:
No, because the Content Security Policy only allows for JavaScript from js.example.com
For instance, 0/**/or/**/1 is the same as 0 or 1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H?
9.0 or Critical. It is not a 10 because the Attack Complexity (AC) is High (H) and not Low (L)
A):
A01 Broken Access Control
A02 Cryptographic Failures
A03 Injection
A04 Insecure Design
A05 Security Misconfiguration
A06 Vulnerable and Outdated Components
A07 Identification and Authentication Failures
A08 Software and Data Integrity Failures
A09 Security Logging and Monitoring Failures
A10 Server-Side Request Forgery (SSRF)
B):
A01 Broken Access Control
A02 Cryptographic Failures
A03 Insecure Design
A04 Injection
A05 Security Misconfiguration
A06 Vulnerable and Outdated Components
A07 Software and Data Integrity Failures
A08 Identification and Authentication Failures
A09 Security Logging and Monitoring Failures
A10 Server-Side Request Forgery (SSRF)
Well, You are a Newbie!
It seems you are just starting out. Your effort is commendable though.
Awesome! You are experienced!
Well done! You have an understanding of Appsec fundamentals.
Whoa! You are an Expert!
That's some great score!
You have an excellent hold on all the nuances of Appsec. People learn from you, but don't forget there is always room for improvement. Keep on learning and inspiring others. The digital world needs you!