Notes

Q What is a Distributed Reflection Denial of Service (DRDoS) attack?

The attacker sends small requests with the victim's spoofed IP as the source to many third-party servers, which then flood the victim with their (usually amplified) replies. * Reflection hides the attacker; amplification multiplies the traffic that lands on the victim. * This co...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

Q What does the HSTS header do, and what is the role of max-age and includeSubDomains?

HSTS tells the browser "always connect to this site over HTTPS; never accept HTTP" for a period of time. Strict-Transport-Security: max-age=31536000; includeSubDomains max-age=31536000 — remember this rule for 1 year (in seconds). The header must be re-served on each HTTPS visit...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

Q Why is it a bad idea to generate session cookie values sequentially (sessionid=0000000001, 000000000...

If session IDs are predictable, an attacker who has any valid ID (their own) can guess everyone else's by incrementing — instantly hijacking other users' sessions. The attack: Attacker logs in legitimately, gets sessionid=0000000042. Attacker swaps in sessionid=0000000043 — now...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

Q What is the difference between DoS and DDoS, and what general defenses exist?

Both make a system unreachable through overload — DoS comes from one source, DDoS comes from many distributed sources simultaneously. DDoS is much harder to mitigate because you can't simply blocklist one IP. Attack traffic comes from a botnet of compromised devices (IoT cameras,...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

Q What does X-Frame-Options: deny protect against, and what attack is it the textbook defense for?

It tells the browser "don't let any other site embed me in a <frame>, <iframe>, or <object>" — defeating clickjacking. * A transparent iframe of the real page under a decoy steals the click; framing controls block it. * Clickjacking: the attacker loads your site (say, your bank'...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

Q What is the Same-Origin Policy (SOP) and what does an "origin" consist of?

The browser rule that a script loaded from origin A may not read data from origin B. An origin is the triple (scheme, host, port) — all three must match. * Same origin = identical scheme, host and port; change any one and it's a different origin. * Without SOP, evilcom's JavaScr...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

Q What does OWASP A3 — Sensitive Data Exposure cover, and how should you defend against it?

Attackers stealing keys, passwords, business secrets, or personal data — from the server, during transmission, or from the client. The category covers any case where sensitive data is stored, transmitted, or cached without adequate protection. The classic example is plaintext FTP...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

Q What does X-Content-Type-Options: nosniff do?

Tells the browser to trust the server's Content-Type header and not "sniff" the actual file contents to guess a different type. Without it, browsers historically tried to be helpful: if a server said Content-Type: text/plain but the file started with <html>, the browser might ren...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

Q How does the Same-Origin Policy apply to cookies specifically — what are the rules for setting and s...

Cookies follow their own SOP based on the Domain and Path attributes (which are looser than the script SOP — they're per-domain, not per-origin). Setting (Set-Cookie: ...; Domain=...): A server may only set cookies for its own host or a parent domain suffix. It may not set cooki...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

Q What is a buffer overflow at a memory-safety level, and what classic mistake causes one in C?

A program writes past (or reads past) the end of a memory region — corrupting adjacent data or leaking it. * With no length check, strcpy writes past the buffer's end into adjacent memory. * In C/C++ this happens when you trust input size assumptions. The textbook example: #defi...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026