CAP-C01 cheat sheet

Same-origin policy compares scheme, host, and port; a mismatch in any one component makes a cross-origin request.

Stored XSS persists in the datastore and executes for every viewer; reflected XSS executes only in the response to the crafted request.

Content-Security-Policy with 'unsafe-inline' or wildcard sources negates most of the protection against script injection.

CSRF defenses rely on unpredictable tokens or SameSite cookies; checking Origin/Referer headers is a compensating control.

SQL injection arises when user input changes query structure; parameterized queries separate code from data and eliminate it.

HTTPOnly blocks JavaScript access to cookies; Secure restricts transmission to HTTPS; neither prevents CSRF by itself.

Insecure Direct Object Reference is an authorization flaw: the object identifier is exposed and access control is missing or weak.

Open redirects and SSRF both abuse server-side trust; SSRF targets internal addresses and cloud metadata endpoints such as 169.254.169.254.

ARP spoofing maps an attacker MAC to a victim IP; dynamic ARP inspection on switches mitigates it.

LLMNR and NBT-NS poisoning captures NetBIOS name resolution traffic when DNS fails; disabling both protocols removes the vector.

Kerberoasting requests service tickets for accounts with SPNs and cracks them offline; detection focuses on anomalous TGS requests.

Pass-the-hash abuses NTLM authentication without knowing the plaintext password; credential tiering limits lateral movement.

802.1X port-based authentication gates network access on supplicant credentials before assigning a VLAN.

VLAN hopping via double tagging or switch spoofing is countered by disabling unused ports and forcing trunk configuration.

SMB signing prevents relay attacks; disabling SMBv1 removes a legacy exploitation surface.

Segmentation between workstation, server, and management zones limits blast radius; flat internal networks allow unrestricted lateral movement.

DMZ hosts internet-facing services; a compromise there should not grant direct access to the internal core.

TLS certificate validation checks chain of trust, hostname match, and validity dates; pinning adds an expected key or hash.

DNS cache poisoning corrupts resolver records; DNSSEC provides origin authentication and integrity of DNS answers.

Port scanning results distinguish open, closed (RST), and filtered (no response or ICMP unreachable) states.

BGP hijacking redirects traffic by announcing more specific prefixes; RPKI validates route origin authorization.

DDoS mitigation layers volumetric scrubbing, protocol-level filtering, and application-layer rate limiting.

Exposed management interfaces (RDP, SSH, admin panels) on public IPs are a primary initial-access vector.

Certificate transparency logs reveal subdomains; reconnaissance should inventory all externally resolvable names.

Android app data is sandboxed per UID; rooted devices and debuggable builds break the isolation guarantee.

Insecure data storage includes world-readable files, unencrypted SQLite databases, and secrets in SharedPreferences or logs.

Certificate pinning in mobile apps defeats user-installed proxy interception unless the pinning is bypassed on a rooted device.

iOS keychain items are protected by classes such as WhenUnlocked and Always; accessibility settings determine exposure.

Android exported components without permission checks allow other apps to invoke activities, services, or receivers.

Jailbreak/root detection and anti-tampering are client-side controls and are bypassable; they are deterrents, not guarantees.

Deep links and intent redirection can leak data or invoke privileged functionality if input is not validated.

Mobile backend APIs must enforce authorization server-side; client-side checks are trivially bypassed.

Taint analysis tracks data from sources (user input) to sinks (query, exec, file write); a sanitizer on the path breaks the flow.

Static analysis produces false positives when it cannot resolve dynamic dispatch or reflection; triage is required.

Hardcoded secrets in source or history require rotation, not just deletion, because history retains prior commits.

Deserialization of untrusted data is dangerous in Java, PHP, and Python (pickle); prefer safe formats like JSON.

Race conditions (TOCTOU) occur when a check and a use are not atomic; locking or atomic operations close the gap.

Buffer overflows in C/C++ stem from unchecked copies; safe functions and bounds checks mitigate them.

Command injection occurs when input reaches a shell; avoiding shell invocation and using argument arrays prevents it.

Dependency analysis flags vulnerable third-party libraries; transitive dependencies count and must be inventoried.

Shared responsibility: the provider secures the cloud infrastructure; the customer secures identity, data, and configuration.

Overly permissive IAM policies (wildcard actions or resources) are the most common cloud privilege-escalation path.

Public object storage buckets expose data; assessment checks bucket ACLs and policies for anonymous read or write.

Instance metadata services can leak credentials; IMDSv2 requires a session token and mitigates SSRF credential theft.

Cloud audit logs (CloudTrail, Cloud Audit Logs, Activity Log) record API calls and are essential for detection and forensics.

Security groups are stateful and default-deny; network ACLs are stateless and evaluated in order.

Cross-account role assumption with weak trust policies enables lateral movement between cloud accounts.

Key management: customer-managed keys give control over rotation and revocation; provider-managed keys do not.