Blog

The login API sends this query in MongoDB: db.users.find({email: $_POST[‘e’], password: $_POST[‘p’]}) An attacker sends: {“email”: {“$ne”: “”}, “password”: {“$ne”: “”}} They are logged in as the first user. What is this attack? 

Which access control failure occurs when users can access other users’ data of the same type?

Which technique is used to detect blind OS command injection when no output is returned in the HTTP response?

A product stock-check feature accepts a full URL in a POST body. Attacker changes: stockApi=http://stock.weliketoshop.net:8080/… to stockApi=http://127.0.0.1/admin The server fetches internal admin content and returns it. This is:

Why can insecure design not be fixed by perfect implementation?

Which of the following is TRUE about symmetric encryption?

What key advantage does passive reconnaissance provide over active reconnaissance? 

Which injection occurs when unsafe user input is dynamically inserted into a template engine?

Which statement about “pepper” in password hashing is correct?

Please match the following with the correct answer choice.