Reference no: EM133973668
Questions
1. How did security technologies evolve in terms of the web application perimeter? Why is this evolution important in understanding the effective security of web applications in today's world?
2. Most web applications handle access using a trio of interrelated security mechanisms: Authentication, Session Management, and Access Control. What are the differences among these?
3. Why is "Reject Known Bad", also referred to as "Blacklisting", regarded as the least effective approach to validating user input?
4. Why is "Accept Known Good", also referred to as "Whitelisting", not always a possible/feasible approach to validating user input?
5. An input validation mechanism designed to block cross-site scripting attacks performs the following sequence of steps on an item of input:
a) Strip any <script> expressions that appear.
b) Truncate the input to 50 characters.
c) Remove any quotation marks within the input.
d) URL-decode the input.
e) If any items were deleted, return to step (a).
Can you think of a scheme to bypass this validation mechanism to smuggle the following data past it? You must show each of the steps by which the data can be smuggled.