Web Security Exam Study Guide

The following would be good to know for the assessment exam:

• The differences between SQL and NoSQL injection, especially regarding MongoDB.
• A summary of the OWASP top-ten threats for 2017
• How hash algorithms work as a one-way data transformation.
• About base64 encoding and its purpose and uses.
• The different forms of injection and how each of them work.
• The basics of threat modeling
• How an attacker mounts a cross-site scripting attack.
• What kinds of vulnerabilities exist for XML-based web services and how to mitigate them.
• The difference between positive and negative validation.
• The various ways to mitigate SQL injection vulnerabilities.
• The basics of how the Java Bean Validation framework lets you configure validation rules for bean properties.
• How frameworks such as Spring Security let you apply authorization at the method level.
• Why web-based applications should not only validate input, but also output.
• The basics of public-private key infrastructure.
• What rainbow tables are and how to mitigate their usage by hackers.
• How SOAP-based web services are susceptible to XML vulnerabilities.
• The importance of proper logging and monitoring for web applications.
• The difference between attacks that use under-posting and over-posting.
• How to properly work with passwords, especially regarding hashes and salt.
• How to use ZAP to perform penetration testing.
• The best practices for mitigating session-based attacks by hackers.
• The best practices for decreasing your app's attack surface, especially regarding showing development-level info to users such as stack traces.
• How application logs could potentially be vulnerable to attack.
• How to protect messages from being tampered with as they travel across a non-secure network.
• What escaping is and how it helps protect against attacks that involve mixing code and data that's then parsed by the vulnerable application.
• The benefits and limitations of client-side validation in the web environment.
• The fundamentals of STRIDE and how to apply during threat modeling.