Short note

Web browser attacks

Cross site request forgery

Email attacks

Define wed security. Explain the role of cookies. 5m

Explain the role of SSH. What is the difference between HTTP and HTTPS 10

Explain Penetration testing in detail. 10 m

Clickjacking, Session Hijacking, and Session

Management
✍️1. Clickjacking (1 Page Answer)
Clickjacking is a type of malicious attack where the attacker tricks the user into clicking
something different from what the user perceives. The term comes from "click" +
"hijacking" — the attacker hijacks your click to perform unintended actions.
It is also known as User Interface (UI) redress attack because the attacker manipulates the
interface to hide or disguise a clickable element (like a button, link, or form) behind another
visible element. The user thinks they are clicking on a harmless button, but in reality, they
are clicking on something dangerous like:
 Submitting a form
 Making a payment
 Changing account settings
 Liking/sharing on social media
Clickjacking mainly exploits user trust and browser rendering of UI, making it dangerous if
not detected.
⚙️How Clickjacking Works:
The attacker typically uses HTML and CSS tricks like:
 <iframe> to embed the actual target page
 CSS opacity to make the real content invisible
 Precise positioning to overlay a fake button over the real one
So, the user sees and interacts with the top layer but unknowingly triggers the underlying
action.
🧪 Example:
You click a visible button that says “Watch Video,” but the actual click is on a hidden button
saying “Send Money” placed beneath it using an invisible iframe.
🔥 Impact of Clickjacking:
 Unauthorized actions on behalf of the user
 Social media misuse (e.g., auto-liking)
 Banking or financial loss
 Spreading malware or phishing links

✍️2. Session Hijacking (1 Page Answer)

Session hijacking is a cyberattack where the attacker gains unauthorized access to a user’s
active session with a web application or website. Instead of logging in themselves, they steal
the session ID that is used to identify the logged-in user.
In most web applications, after a user logs in, a session ID is generated and stored in a
cookie. This ID is used to maintain the session without needing the user to re-enter
credentials. If an attacker gets this session ID, they can pretend to be the user.
Techniques Used in Session Hijacking:
Session Sniffing: Intercepting network traffic to steal session ID
Cross-site Scripting (XSS): Injecting scripts to extract cookies
Session Fixation: Forcing a known session ID onto the user.
Man-in-the-Middle (MITM): Intercepting communication between user and server.
🧪 Example:
A user logs into an e-commerce website. The attacker somehow captures the session ID
from the user’s browser (via XSS). Now the attacker can browse as that user, view personal
info, and place orders.
Session hijacking targets the confidentiality and integrity of web sessions, making it a
serious security issue.
✍️3. Session Management (1 Page Answer)
Session management is the process of handling user sessions securely in web applications.
A session starts when a user logs in and continues until they log out or the session expires.
If session management is weak, it can lead to hijacking, fixation, or replay attacks.
A good session management system ensures:
 The session is unique and securely generated
 The session is properly maintained
 The session is safely destroyed when no longer needed
🧱 Key Concepts in Session Management:
1. Session ID Generation:
o Should be random, unique, and unpredictable
o Stored securely (usually in cookies)
2. Session Storage:
o Use HttpOnly and Secure cookie flags to prevent access via JavaScript and
ensure transmission over HTTPS
3. Session Timeout:
o Inactive sessions should automatically expire after a defined time (e.g., 15-30
minutes)
4. Session Termination:
o When user logs out, session should be destroyed both client-side and server-
side
5. Session Regeneration:
o On login, generate a new session ID to prevent session fixation

🧪 Example:
In online banking, when a user logs in, a secure session is created. If the user is inactive for
10 minutes, the session expires. This is session timeout, preventing misuse if the user
forgets to log out.
✅ Best Practices:
 Use HTTPS at all times
 Avoid passing session ID in URL
 Always regenerate session ID on login/logout
 Implement proper timeout and auto-logout
Good session management helps protect user data, prevent impersonation, and maintain
trust and security of the web application.
✅ Different Types of Firewalls and the Layers They Operate On
(Full theory format with proper points, covers 1–1.5 pages)

🔒 What is a Firewall?
 A firewall is a network security system that monitors and controls incoming and
outgoing network traffic.
 It works based on predefined security rules.
 The main goal is to protect internal systems from unauthorized access, malware,
and cyber attacks.
 Firewalls can be hardware, software, or a combination of both.
 They operate at different layers of the OSI (Open Systems Interconnection) model,
depending on the type.
🔰 1. Packet Filtering Firewall
 Operates at: Network Layer (Layer 3).
 Checks packets based on:
o Source IP address
o Destination IP address
o Protocol (TCP/UDP)
o Port numbers
 It either allows or blocks traffic based on these values.
 Does not check packet content.
 Advantages:
 Fast and simple
 Low resource usage
Disadvantages:
 Cannot track connection state
 Vulnerable to spoofing attacks
🔰 2. Stateful Inspection Firewall (Dynamic Packet Filtering)
 Operates at: Network and Transport Layers (Layer 3 & 4).
 Tracks the state of active connections.
  Maintains a state table to allow only valid, established connections.
 It can understand the context of traffic (e.g., request/response matching).
 Advantages:
o More secure than packet filtering
o Blocks unauthorized or suspicious connections
 Disadvantages:
o Slower than simple packet filtering
o Requires more memory and processing

🔰 3. Application-Level Gateway (Proxy Firewall)

 Operates at: Application Layer (Layer 7).
 Acts as a proxy server between user and service.
 Analyzes the actual data in the traffic (e.g., URLs, web content).
 Can block specific commands or applications (e.g., file uploads).
 Advantages:
o Deep inspection of traffic
o Detects application-level threats
 Disadvantages:
o Slower performance
o Requires separate configuration for each application
🔰 4. Circuit-Level Gateway
 Operates at: Session Layer (Layer 5).
 Monitors the TCP handshakes and session establishment process.
 It verifies if the session is valid before allowing traffic.
 Does not inspect the content of the packets.
 Advantages:
o Lightweight
o Faster than application firewalls
 Disadvantages:
 o Less secure
o Cannot filter based on application content
🔰 5. Next-Generation Firewall (NGFW)
 Operates at: Multiple Layers (from Layer 3 to Layer 7).
 Combines multiple features like:
o Packet filtering
o Stateful inspection
o Deep packet inspection
o Intrusion detection
o Application awareness
 Can identify and block modern threats like malware, ransomware, and unauthorized
apps.
 Advantages:
o Very secure and intelligent
o Handles modern cyber threats
 Disadvantages:
o Expensive
o Requires skilled management and configuration

✅ Conclusion
 Different firewalls serve different purposes based on the security needs of a
network.
 Choosing the right firewall depends on factors like security level, network
complexity, and cost.
 Understanding their OSI layer operation helps in better network design and threat
protection.

✅ Penetration Testing (Pen Testing) – Explained in Sentence Points

1. Penetration testing is a simulated cyberattack on a system or network to check for
security vulnerabilities that an attacker could exploit.
 2. It is done by ethical hackers or security experts who try to find and fix weaknesses
before real hackers do.
3. The goal is to evaluate the system's security by identifying risks like software bugs,
misconfigurations, weak passwords, or open ports.
4. Pen testing is a part of a broader security practice known as Vulnerability
Assessment and Penetration Testing (VAPT).
5. There are different types of penetration testing, such as:
o Black-box testing: The tester has no prior knowledge of the system.
o White-box testing: The tester has full knowledge of the system (code,
architecture).
o Gray-box testing: The tester has partial knowledge of the system.

[Link] testing is usually done in five major phases:

 Planning and Reconnaissance: Define the scope and gather information about the
target.
 Scanning: Use tools to detect open ports, services, and vulnerabilities.
 Gaining Access: Attempt to exploit vulnerabilities (e.g., SQL injection, phishing).
 Maintaining Access: Check if long-term access can be maintained (to test
persistence).
 Analysis and Reporting: Document the findings and suggest security improvements.
Tools like Nmap, Metasploit, Burp Suite, and Wireshark are commonly used in
penetration testing.
[Link] like Nmap, Metasploit, Burp Suite, and Wireshark are commonly used in
penetration testing.
8. Penetration testing helps organizations to understand their security posture and comply
with security standards
9. It can be done on web applications, networks, wireless systems, and mobile apps,
depending on what needs to be tested.
10. Regular pen testing improves security awareness, reduces risk, and helps in early
detection of weaknesses before an actual breach occurs.

[Link] between http and https

Aspect HTTP HTTPS

Full Form HyperText Transfer Protocol HyperText Transfer Protocol Secure

Not secure; data is sent in plain

Security Secure; data is encrypted
text

Encryption No encryption Uses SSL/TLS for encryption

Port Used Uses port 80 Uses port 443

URL Format Begins with http:// Begins with https://

Browser
No padlock icon shown Shows padlock icon in address bar
Indicator

Used for login, payments, and sensitive

Usage Used for normal websites
data

Slightly faster (no encryption Slightly slower (due to encryption

Speed
overhead) process)

🔐 Role of SSH – Key Points (Simple Language)

[Link] means Secure Shell, a protocol used to safely connect to another computer over the
internet.
[Link] is mainly used by system administrators and developers to remotely access servers and
perform tasks like file transfer, software updates, and system monitoring.
[Link] ensures confidentiality and integrity of data by using strong encryption, so even if
data is intercepted, it cannot be read.
4. It replaces older, insecure protocols like Telnet and FTP, which send data in plain text.
5. SSH uses public-key and private-key encryption for authentication, making it much
harder for attackers to gain unauthorized access.
6. It also helps to transfer files securely using SCP or SFTP.
7. In short, SSH is like a safe tunnel between your PC and another computer/server.
[Link] works on port number 22.

Q.) Define wed security. Explain the role of cookies.

Web security means protecting websites, web applications, and online services from cyber
attacks that aim to steal data, damage systems, or misuse user information.
Goal of Web Security: To ensure the confidentiality, integrity, and availability of data and
services on the web.
🍪 Role of Cookies in Web Security
1. Cookies are small data files stored in the user’s browser by websites.
2. They are used to remember user information like login sessions, preferences, and
shopping cart details.
3. Session cookies help keep a user logged in as they move between pages of a
website.
4. Persistent cookies store data for a longer time, like remembering login info across
visits.
🍪 Role of Cookies in Web Security
1. Cookies are small data files stored in the user’s browser by websites.
2. They are used to remember user information like login sessions, preferences, and
shopping cart details.
3. Session cookies help keep a user logged in as they move between pages of a
website.
4. Persistent cookies store data for a longer time, like remembering login info across
visits.
5. Cookies can be secured using flags like:
 o HttpOnly: Prevents JavaScript from accessing cookies (protects from XSS
attacks).
o Secure: Sends cookies only over HTTPS (prevents sniffing).
o SameSite: Prevents cross-site request forgery (CSRF).
6. If not managed properly, cookies can be exploited for attacks like:
o Session hijacking
o Identity theft
o Tracking without consent
7. Hence, cookies must be securely stored, transmitted, and managed to protect user
privacy and data.

1️⃣ 🔓 Web Browser Attacks – Short Note (5 Marks)

🔹 What are Web Browser Attacks?
Web browser attacks are cyber attacks that target the user’s browser or its components to
steal information, install malware, or hijack sessions.
🔹 Key Points:
1. Browsers are common entry points because users visit many websites, some of
which may be malicious.
2. Attackers exploit vulnerabilities in browser plugins, extensions, or outdated
versions.
3. These attacks can occur without the user’s knowledge (called drive-by downloads).
4. Attackers can use malicious JavaScript or ads (called malvertising) to control browser
actions.
5. Common web browser attacks include:
o Man-in-the-Browser (MitB): Injects malware into the browser.
o Clickjacking: Tricks user into clicking something hidden.
o Session Hijacking: Attacker steals session ID stored in browser cookies.
6. Users are often tricked through phishing websites and fake updates.
7. Prevention includes:
o Regular browser updates
 o Avoiding suspicious extensions
o Using ad-blockers and anti-malware tools

🔁 Cross-Site Request Forgery (CSRF) – Key Point Format Answer

🔹 Definition:
Cross-Site Request Forgery (CSRF) is a type of web security vulnerability where an attacker
tricks a user’s browser into performing unauthorized actions on a trusted website where the
user is already logged in.

🔹 Key Points:
1. Exploits User Trust:
CSRF attacks target authenticated users and misuse their active session with a
trusted site.
2. How it Works:
The attacker sends a malicious link or form to the user. When the user clicks it, the
browser unknowingly sends a valid request to the target website using existing
cookies/session.
3. No Need to Steal Cookies:
Unlike session hijacking, CSRF does not steal session IDs or cookies — it just uses
them silently through the browser.
4. Example Scenario:
 o User is logged in to their bank account.
o Attacker sends an email or link to a malicious website.
o That website contains a hidden form that auto-submits a money transfer
request.
o The bank executes the request thinking it came from the logged-in user.
5. Common Impact:
o Changing user settings (like password/email)
o Performing transactions (like money transfer)
o Deleting or modifying data
6. Affected Applications:
Any web app that relies only on cookies for session management and doesn’t verify
user intention is vulnerable.
7. Prevention Techniques:
o Use anti-CSRF tokens in every form/request.
o Enforce SameSite cookie attribute to block cross-site use.
o Use CAPTCHA for critical actions.
o Verify requests with Referer or Origin headers.
o Logout when not in use and avoid multiple open sessions.

🔹 Conclusion:
CSRF is a dangerous attack because it uses the user’s own browser and login session to
perform actions without their knowledge. Proper security checks and token-based
validation can effectively prevent CSRF attacks.

📧 Email Attacks – Key Point Format Answer

🔹 Definition:
Email attacks are cyber attacks that use email communication as a medium to trick users
into revealing sensitive information, clicking malicious links, or downloading harmful files.
These are one of the most common and dangerous methods used in social engineering and
phishing.

🔹 Key Points:
1. Used for Social Engineering:
Attackers use email to manipulate people into giving up confidential info like
passwords, OTPs, or financial details.
2. Spoofed Sender Address:
Often, emails are sent using fake sender IDs that look similar to a real organization
(like "support@[Link]" instead of "[Link]").
3. Phishing Emails:
These emails contain fake links that redirect users to a fraudulent website that looks
like a trusted one. Users unknowingly enter their login details there.
4. Malware Attachments:
Some emails contain attachments (PDF, ZIP, EXE) which when opened, install viruses,
trojans or ransomware on the user’s system.
5. Business Email Compromise (BEC):
In BEC attacks, attackers pose as CEOs or employees, and trick staff into transferring
money or sensitive info by impersonating internal staff via email.
6. Spam & Scams:
Email attacks can also include lottery scams, fake job offers, and investment frauds,
where users are lured into sharing bank info or paying fees.
7. Links to Fake Login Pages:
Clicking these links leads to a login page that looks real (like Gmail, Facebook), but it
steals credentials.
8. Mass Targeting:
Email attacks are often done on a large scale using email blasting tools to reach
thousands of users at once.

🔹 Prevention Techniques:
 Always verify sender’s email before responding.
 Never click on suspicious links or open unknown attachments.
 Use spam filters and email scanning software.
 Enable 2-factor authentication (2FA) on email accounts.
 Regularly update antivirus software.
  Educate users about phishing awareness.

🔹 Conclusion:
Email attacks exploit human trust and can cause major data breaches or financial loss.
Awareness and technical security controls are the best defense against such threats.