WGU D385- LOGGING AND
SECURITY ISSUES ACTUAL EXAM ALL
QUESTIONS AND WELL ELABORATED
ANSWERS ALREADY A+ GRADED
WITH EXPERT FEEDBACK TOP RATED
VERSION|NEW AND REVISED
Save
Practice questions for this set
Learn
Studied 7 terms
Nice work, you're crushing it
Continue studying in Learn
,Terms in this set (119)
- printing out values of variables
- changing the state ("path") of the
program to make it do different things
- stepping through the execution of a
What are some
program line by line
common
- breakpoints
debugging
- trace points
techniques?
- stopping the program at certain
events
- viewing the output of a program in a
debugger window
- pdb: most commonly used
What are some - Web-PDB
Python debugging - wdb
tools? - Pyflame
- objgraph
- XXE
- when attackers exploit an XML parser
XML External
to read arbitrary files on your server
Entity Attacks
- attackers might also be able to read
config files, retrieve user information
, - serialization is the conversion of an
object in a programming language is
saved into a format that can be saved to
a database
- DEserialization is when a serialized
Insecure object is read from a file or the network
Deserialization and converted back into an object
- INSECURE DESERIALIZATION occurs
when an attacker can manipulate the
serialized object and achieve
authentication bypass, DOS, or arbitrary
code execution
- when an application cannot properly
distinguish between untrusted user data
Injection Attacks and code
- typically allows for arbitrary code
execution
SQL Injection - use parameterized statements
Attack Mitigation
- prefixing log entries with meta-data
Log Injection (i.e. timestamp)
Attack Mitigation - validate the entry before accessing or
opening
SECURITY ISSUES ACTUAL EXAM ALL
QUESTIONS AND WELL ELABORATED
ANSWERS ALREADY A+ GRADED
WITH EXPERT FEEDBACK TOP RATED
VERSION|NEW AND REVISED
Save
Practice questions for this set
Learn
Studied 7 terms
Nice work, you're crushing it
Continue studying in Learn
,Terms in this set (119)
- printing out values of variables
- changing the state ("path") of the
program to make it do different things
- stepping through the execution of a
What are some
program line by line
common
- breakpoints
debugging
- trace points
techniques?
- stopping the program at certain
events
- viewing the output of a program in a
debugger window
- pdb: most commonly used
What are some - Web-PDB
Python debugging - wdb
tools? - Pyflame
- objgraph
- XXE
- when attackers exploit an XML parser
XML External
to read arbitrary files on your server
Entity Attacks
- attackers might also be able to read
config files, retrieve user information
, - serialization is the conversion of an
object in a programming language is
saved into a format that can be saved to
a database
- DEserialization is when a serialized
Insecure object is read from a file or the network
Deserialization and converted back into an object
- INSECURE DESERIALIZATION occurs
when an attacker can manipulate the
serialized object and achieve
authentication bypass, DOS, or arbitrary
code execution
- when an application cannot properly
distinguish between untrusted user data
Injection Attacks and code
- typically allows for arbitrary code
execution
SQL Injection - use parameterized statements
Attack Mitigation
- prefixing log entries with meta-data
Log Injection (i.e. timestamp)
Attack Mitigation - validate the entry before accessing or
opening
