Interview Questions Answers.ORG
Interviewer And Interviewee Guide
Interviews
Quizzes
Home
Quizzes
Interviews Basic Job Interviews:AbilitiesAbroad JobsActivistAmbitionAnalyticalAptitudeAptitude KnowledgeAssertivenessAuthority / DecisivenessBasic CommonBasic Salary RequirementsBehavioralBehavioral BasedBody LanguageBusiness intelligenceCandidate Selection CriteriaCareer StatementsCareers FutureCaseCitizenshipCommunication SkillsComputer BasicsComputer securityConfidence BuildingConflictCorporate CommunicationCreativeCreativityCurrent Affairs 2009Current Affairs 2010Current Affairs 2011Dangerous JobsDecision MakingDetail SkillsDeterminationDifficultDream JobEmployers To AskEntry LevelEthicsExitFace to FaceFailuresFlexibilityFollow UpFrequently AskedFreshers GraduateFunnyFunny QuotesFuture Career PlanningGeneral KnowledgeGeneral SkillsGood EmployeeGood LeaderGraduationGroupGroup DiscussionsHackingHandle StressHard WorkerHotel TourismHow to AnswerIllegalIncidentInitiativeInitiative WorkplaceInteresting CareerInterestsJobJob AttireJob AwarenessJob DemotionJob Follow Up LetterJob KnowledgeJob PerformanceJob ProtocolJob Search TacticsJob TipsJudgmentLearning SkillsLinkedIn RecommendationListening SkillsLogicalMannersMental AttitudeMid LifeMost Inspiring JobsMotivationNegotiate Pay RaiseNegotiation SkillsNo ExperienceNo Work ExperiencePanelPart Time ContractPatiencePay PackagePersonalPersonality TraitsPhonePlacement AssistancePost GraduatePotential EmployeePresent JobProblem SolvingProblem Solving SkillsProhibitedProjectsPuzzlesQuality On TimeQuantitativeQuantitative AptitudeRecession Proof JobReferencesResignationResume FormatResume HelpResume ObjectivesResume Skill SetSalarySalary NegotiationSecond InterviewSecond RoundSecretarySelf AssessmentSelf WorthinessSituationalSkypeStatics ProbabilityStrange JobsTargeted SelectionTeamworkTeamwork MotivationTechnology SkillsTeenTelephone OperatorTelephonicToughTraining AdviceTrickyTypicalUnusualVideoVisaWarm UpWeaknesses and StrengthsWork EthicsWork HistoryWorkplace FlexibilityWritten Skills
Copyright © 2018. All Rights Reserved
Computer security Interview Question:
The file is called logon_validate and a typical logon request looks like this?
Submitted by: AdministratorYou have been asked to review the source code for a compiled script that is being used to validate logon credentials for a web application. The file is called "logon_validate" and a typical logon request looks like this -
"GET /cgi-bin/logon_validate?login=test&password=test"
The source code is shown below -
void show_error(void) {
// AUTHENTICATION ERROR
exit(-1);
}
int main(int argc, char **argv) {
char error_on_auth='1';
char user[128];
char pass[128];
char *ch_ptr_begin;
char *ch_ptr_end;
/**********************************/
/* Get Username from Query String */
/**********************************/
ch_ptr_begin=(char *)strstr
(****QUERY_STRING****,"login=");
if (ch_ptr_begin==NULL)
show_error();
ch_ptr_begin+=6;
ch_ptr_end=(char *)strstr(ch_ptr_begin,"&");
if (ch_ptr_end==NULL)
show_error();
*(ch_ptr_end++)=' ';
strcpy(user,ch_ptr_begin);
/**********************************/
/* Get Password from Query String */
/**********************************/
ch_ptr_begin=(char *)strstr(ch_ptr_end,"password=");
if (ch_ptr_begin==NULL)
show_error();
ch_ptr_begin+=9;
ch_ptr_end=(char *)strstr(ch_ptr_begin,"&");
if (ch_ptr_end!=NULL) *(ch_ptr_end++)=' ';
strcpy(pass,ch_ptr_begin);
if ((strcmp(user,GOOD_USER)==0) &&
(strcmp(pass,GOOD_PASS)==0))
error_on_auth='0';
if (error_on_auth=='0') {
// AUTHENTICATION OK!!
} else {
// AUTHENTICATION ERROR
show_error();
}
// return(0); hehe could be evil ;PPPPP
exit(0);
}
This pseudo-code is taken from the NGSec Web Auth Games
http://quiz.ngsec.biz:8080/game1/level6/replicant.php
Do you see any problems with this script?
How could an attacker exploit this script to bypass
the authentication mechanisms in this script?
What are some mitigation options?
Note: Goal of question - This is most likely the most complex question being asked during the interview due to the fact that the applicant will need to apply multiple layers of analysis, including both the attacker and defender perspectives.
Submitted by: Administrator
"GET /cgi-bin/logon_validate?login=test&password=test"
The source code is shown below -
void show_error(void) {
// AUTHENTICATION ERROR
exit(-1);
}
int main(int argc, char **argv) {
char error_on_auth='1';
char user[128];
char pass[128];
char *ch_ptr_begin;
char *ch_ptr_end;
/**********************************/
/* Get Username from Query String */
/**********************************/
ch_ptr_begin=(char *)strstr
(****QUERY_STRING****,"login=");
if (ch_ptr_begin==NULL)
show_error();
ch_ptr_begin+=6;
ch_ptr_end=(char *)strstr(ch_ptr_begin,"&");
if (ch_ptr_end==NULL)
show_error();
*(ch_ptr_end++)=' ';
strcpy(user,ch_ptr_begin);
/**********************************/
/* Get Password from Query String */
/**********************************/
ch_ptr_begin=(char *)strstr(ch_ptr_end,"password=");
if (ch_ptr_begin==NULL)
show_error();
ch_ptr_begin+=9;
ch_ptr_end=(char *)strstr(ch_ptr_begin,"&");
if (ch_ptr_end!=NULL) *(ch_ptr_end++)=' ';
strcpy(pass,ch_ptr_begin);
if ((strcmp(user,GOOD_USER)==0) &&
(strcmp(pass,GOOD_PASS)==0))
error_on_auth='0';
if (error_on_auth=='0') {
// AUTHENTICATION OK!!
} else {
// AUTHENTICATION ERROR
show_error();
}
// return(0); hehe could be evil ;PPPPP
exit(0);
}
This pseudo-code is taken from the NGSec Web Auth Games
http://quiz.ngsec.biz:8080/game1/level6/replicant.php
Do you see any problems with this script?
How could an attacker exploit this script to bypass
the authentication mechanisms in this script?
What are some mitigation options?
Note: Goal of question - This is most likely the most complex question being asked during the interview due to the fact that the applicant will need to apply multiple layers of analysis, including both the attacker and defender perspectives.
Submitted by: Administrator
Copyright 2007-2024 by Interview Questions Answers .ORG All Rights Reserved.
https://InterviewQuestionsAnswers.ORG.
https://InterviewQuestionsAnswers.ORG.