CWICP flashcards
CWICP · Build recall with a focused review session.
35 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Idempotent HTTP methods
- GET, HEAD, PUT, DELETE, OPTIONS, and TRACE can be repeated with the same effect. POST and PATCH are not idempotent, so automatic retries can duplicate actions.
- HTTP 401 versus 403
- 401 Unauthorized means authentication is missing or failed. 403 Forbidden means the requester is identified but lacks permission for the resource.
- Same-origin policy
- Two URLs share an origin only when scheme, host, and port all match. A different port on the same host is a different origin for browser security checks.
- Cache-Control no-store
- The response must not be stored in any cache. no-cache differs: it permits storage but requires revalidation with the server before each reuse.
- Certificate transparency logs
- Public append-only records of issued TLS certificates. Searching a domain in these logs reveals subdomains listed in Subject Alternative Names without sending traffic to the target.
- DNS zone transfer AXFR
- A query to an authoritative name server requesting the full zone. Success exposes all records and indicates misconfiguration; secure servers refuse transfers to unauthorized clients.
- Wildcard DNS in enumeration
- A wildcard record makes every subdomain resolve. Brute-force tools must subtract a baseline response from a random name to avoid false positives.
- Passive reconnaissance
- Gathering data from third-party sources such as search engines, WHOIS, and certificate logs without directly contacting the target, leaving no target-side logs.
- Password spraying
- Trying one common password across many accounts to avoid lockout thresholds. Credential stuffing instead replays breached username and password pairs.
- Session fixation
- An attacker pre-sets a session identifier that remains valid after the victim logs in. The defense is issuing a new session ID at authentication.
- HttpOnly cookie attribute
- Prevents JavaScript from reading the cookie, reducing the impact of cross-site scripting on session theft. It does not stop the cookie being sent with requests.
- Username enumeration
- Inferring valid accounts from differences in response body, status code, or timing on login and password-reset flows. Uniform responses and timing mitigate it.
- Insecure direct object reference
- An object identifier such as an account ID or filename is used without a server-side ownership check, letting one user access another user's records.
- Vertical privilege escalation
- Gaining access to functionality of a higher role, such as a standard user reaching administrative endpoints because the server does not check role.
- Missing function-level access control
- Administrative endpoints are hidden in the interface but not protected server-side. Direct requests to the URL succeed for any authenticated user.
- Multi-tenant isolation
- Tenant identity must be derived from the authenticated session, never from a client-supplied header, parameter, or subdomain alone.
- Union-based SQL injection
- Appends a UNION SELECT statement to the original query. It requires matching the column count and compatible data types in each position.
- Blind SQL injection
- No data is returned directly. Boolean conditions or time delays reveal information one bit at a time based on differing responses.
- Server-side template injection
- User input is evaluated as template source. A payload like {{7*7}} returning 49 confirms it. The fix is treating input as data, not template code.
- XML external entity injection
- An XML parser resolves external entities defined in the DOCTYPE. It can read local files or make outbound requests. Disabling external entity resolution prevents it.
- Server-side request forgery
- The server fetches a URL supplied by the user. Attackers target internal addresses and cloud metadata endpoints. Mitigate with destination allow-lists and redirect blocking.
- DOM-based cross-site scripting
- Client-side JavaScript writes attacker-controlled data into a dangerous sink such as innerHTML or eval. The payload never needs to reach the server.
- Content Security Policy
- A response header restricting which sources may load scripts, styles, and other resources. Nonce- or hash-based script policies are stronger than broad host allow-lists.
- Cross-site request forgery
- A malicious site triggers a state-changing request using the victim's ambient cookies. Per-request tokens and SameSite cookies are the standard defenses.
- CORS misconfiguration
- Reflecting the request Origin into Access-Control-Allow-Origin together with Allow-Credentials true lets any website read authenticated responses.
- HSTS header
- Strict-Transport-Security with max-age and includeSubDomains instructs browsers to use HTTPS only, preventing downgrade and cookie leakage over plain HTTP.
- Password hashing algorithms
- bcrypt, scrypt, and Argon2 are designed to be slow and salted for password storage. MD5 and SHA-1 are fast and unsuitable for this purpose.
- TLS cipher suite strength
- Prefer AEAD suites such as AES-GCM and ChaCha20-Poly1305. RC4, 3DES, and export-grade suites are weak and should be disabled.
- Security headers baseline
- Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options nosniff, Referrer-Policy, and Permissions-Policy are the common defensive response headers.
- Directory listing exposure
- Web server autoindex serves a file listing for directories lacking an index page. Disable it with Apache Options -Indexes or Nginx autoindex off.
- WAF is not remediation
- A web application firewall filters known patterns but leaves the vulnerability in code. It is defense in depth, not a substitute for fixing the flaw.
- WAF evasion via encoding
- Filters match known patterns while parsers accept equivalent forms. URL, double URL, Unicode, and HTML entity encoding can bypass signature matching.
- CVSS severity ranges
- Base scores map to qualitative ratings: 9.0 to 10.0 critical, 7.0 to 8.9 high, 4.0 to 6.9 medium, and 0.1 to 3.9 low.
- Responsible disclosure
- Reporting a vulnerability privately to the owner and allowing time to fix before public detail. Coordinated disclosure is the professional default.
- Retest verification
- Re-running the reproduction steps after a fix to confirm the vulnerability is closed. A closed ticket without a retest is not confirmed remediation.