WAS621S - WEB APPLICATION SECURITY - 1ST OPP - NOV 2022


WAS621S - WEB APPLICATION SECURITY - 1ST OPP - NOV 2022



1 Pages 1-10

▲back to top


1.1 Page 1

▲back to top


nAmlBIA UnlVERSITY
OF SCIEnCE AnD TECHn OLOGY
Faculty of Computing and Informatics
Department of Computer Science
QUALIFICATION: Bachelor of Computer Science in Cyber Security
QUALIFICATION CODE: 07BCCS
COURSE: Web Application Security
DATE: November 2022
DURATION: 2 hours
LEVEL: 6
COURSE CODE: WAS621S
PAPER: THEORY
MARKS: 80
FIRST OPPORTUNITY EXAMINATION QUESTION PAPER
EXAMINER(S)
MR EDWARD NEPOLO
MODERATOR:
DR MERCY CHITAURO
THIS QUESTION PAPERCONSISTSOF 7 PAGES
{Including this front page)
INSTRUCTIONS
1. Answer ALL the questions.
2. Write clearly and neatly.
3. Number the answers clearly.
4. When answering questions, you should be guided by the allocation
of marks. Do not give too few or too many facts in your answers.
PERMISSIBLEMATERIALS
1. Non-programmable calculator

1.2 Page 2

▲back to top


1.3 Page 3

▲back to top


Section A
[12 Marks]
1. Select a programming interface used to represent a page in a tree structure, so that programs can
read, access and modify document structure.
i. XML ii.
DOM
iii. HTML
iv. JWT
2. ____
allows applications to send and retrieve data from a server without interfering with the
current page.
i. DOM
ii. JWT
iii. XML
iv. AJAX
3. _____
is a networking and cryptography library for encryption, decryption, signatures etc.
i. NaCL
ii. Sockets
iii. HTML
iv. JWT
4. A session is an instance of a sequence of HTTPrequests and responses of a particular user.
Authentication is essential in session management. Which technology is used for authentication
during stateful authentication?
i. Tokens
ii. Cookies
iii. OAuth
iv. JWT
5. Single Sign-On relies on three important elements. What are they? Select 3
i. Users
ii. Service Providers
iii. Organization
iv. Encryption
V. Hashing
vi. Identity Providers
6. During Single Sign-On, the user agent first authenticates through the IDP. What does the IDP do
after verifying the identity of the user agent?
i. The user agent provides the SAML Assertion
ii. The Service Provider sends a verification code to the IDP
iii. IDP issues an SAML Assertion
iv. The IDP sends a verification code to the Service Provider
2

1.4 Page 4

▲back to top


1.5 Page 5

▲back to top


7. How does the Service Provider ensure the integrity of the SAMLassertion?
i. Service Provider signs the SAML Assertion
ii. IDP digitally signs the SAML Assertion
iii. Verification is not required
iv. Service Provider creates a hash of the SAML Assertion
8. Which technology is used to prevent SSLStripping?
i. HTTPSSL
ii. HTTPStrict-Transport-Security
iii. HTTPTLS
iv. HTTP
9. What is the best way to mitigate against SQL Injection attacks on a web application?
i. By authenticating users
ii. By using prepared statements iii.
By reducing the amount of data
iv. By using strict password policies
10. During SQLInjection, which in-band injection technique allows a user to use error responses to
manipulate data?
i. Union Based
ii. Error Based
iii. Out of Band
iv. Inferential
3

1.6 Page 6

▲back to top


1.7 Page 7

▲back to top


Section B
Question 1
1.1 How does Cross-Site Scripting attack work?
[42 Marks]
[4 Marks]
1.2 Explain the different types of Cross-SiteScripting attacks.
[4 Marks]
1.3 Why is HTTPStrict-Transport Security needed when there is already HTTPSecure? [4 Marks]
1.4 There are two authentication methods during authentication in web application session
management. Explain the two methods.
[4 Marks]
1.5 Name two differences in the two authentication methods mentioned in Question 1.4. [4 Marks]
4

1.8 Page 8

▲back to top


1.9 Page 9

▲back to top


1.6 Explain what is meant by a buffer overflow attack?
[4 Marks]
1.7 Mention two attributes that are configured on session cookies and what the attributes imply. [4
Marks]
1.8 Name and explain 3 security measures that can be put in place to ensure that cookies are
secured during communication.
[6 Marks]
1.9 Name and explain three SQLInjection attack modes.
[6 Marks]
1.10 How is SQL Injection different from Cross-Site Scripting?
[2 Marks]
5

1.10 Page 10

▲back to top


2 Pages 11-20

▲back to top


2.1 Page 11

▲back to top


Question 2
[16 Marks]
2.1 Explain the concept of single sign on, and what issues are addressed by single-sign on.
[4 Marks]
2.2 There are three elements that single sign-on depends on, explain the flow of single sign-on.
[6 Marks]
2.3 What is SAML Assertion?
[2 Marks]
2.4 How does the service provider ensure that the SAML Assertion provided is authentic? [4 Marks]
Question 3
3.1 Mention five ways in which you would mitigate against SQL Injections.
[10 Marks]
[S Marks]
6

2.2 Page 12

▲back to top


2.3 Page 13

▲back to top


3.2 Name and explain the type of Man-In-The-Middle attack that can take place if HTTPStrict-
Transport Security is not enabled?
[S Marks]
- END OF EXAMINATION PAPER-
7

2.4 Page 14

▲back to top


nAml !l!A
Un!VERSITY
0 F St.1EnCE Ano
T!:O·HlOLOGY
P/Bag13388
Windhoek
HAMl81A
2022-10-18
FA[UlTYOFCOMPUTlN&GINFORMATICS
DtP/!-,RTMf:ll!CTO: MPUTESRCIENCE