Hands-On Ethical Hacking and Network Defense, 3e, ISBN 9781285454610
Ch. 10 Solutions-1
Chapter 10 Solutions
Review Questions
1. The following code is an example of what language?
2. Which of the following can be used to create dynamic Web pages? (Choose all that
apply.)
3. Which of the following can be used to connect a Web server to a back-end database
server? (Choose all that apply.)
4. What tag is used to indicate ASP code?
5. What is DAST?
6. What is authorization testing?
7. Entering the value ‘ OR 1=1 in a Web application that has an “Enter Your PIN”
field is most likely an example of which attack?
8. HTML Web pages containing connection strings are more vulnerable to attack. True
or False?
9. The AccessFileName directive in Apache, along with a configuration file (such as
.htaccess), can be used to perform which of the following on a Web site?
10. Which of the following is an open-source technology for creating dynamic HTML
Web pages?
11. CGI is used in Microsoft ASP pages. True or False?
12. Name three Web application vulnerabilities from OWASP’s top 10 list.
Correct answers include cross-site scripting (XSS) vulnerabilities, injection
Hands-On Ethical Hacking and Network Defense, 3e, ISBN 9781285454610
Ch. 10 Solutions-2
13. If a Web server isn’t protected, an attacker can gain access through remote
administration interfaces. True or False?
14. Which of the following is used to connect an ASP Web page to an Oracle database?
15. List an organization with online resources for learning more about Web application
vulnerabilities.
16. What tags identify ColdFusion as the scripting language?
17. What tags identify PHP as the scripting language?
18. An HTML Web page containing ASP code must be compiled before running. True or
False?
19. Which of the following can be used to detect a new application vulnerability on a
Web site?
20. IIS is used on more than twice as many Web servers as Apache Web Server. True or
False?
Activities
Activity 10-1
Step 3: IIS version 10
Activity 10-3
Step 4: No, ASP source code isn’t displayed.
Activity 10-4
Step 13: The secret.txt file is displayed.
Step 16: Credentials entered at a Web site without SSL security allow attackers to intercept the
Hands-On Ethical Hacking and Network Defense, 3e, ISBN 9781285454610
Ch. 10 Solutions-3
Activity 10-5
Step 3: Answers will vary because new CVEs are added constantly. As of this writing, there were
about 6,600 SQL injection vulnerabilities. The point is for students to see that there are many
occurrences of SQL injection.
Case Projects
Case Project 10-1: Determining Vulnerabilities of Web Servers
Case Project 10-2: Discovering Web Application Attack Tools