Q. What is the purpose of a ticket granting ticket (TGT) in the Kerberos authentication process?

View solution

Q. In the Kerberos authentication process, what is the role of the key distribution center (KDC)?

View solution

Q. What is the term for attacks that involve reusing a secret key to acquire tickets in Kerberos?

View solution

Q. Why are ticket granting tickets (TGTs) referred to as "golden tickets" in Kerberos attacks?

View solution

Q. What is the main risk associated with compromised key distribution centers (KDCs) in Kerberos?

View solution

Q. What is the authentication process in Kerberos when users initially obtain a ticket granting ticket (TGT)?

View solution

Q. What is the central role of Kerberos in handling authentication on untrusted networks?

View solution

Q. What type of attacks do Kerberos ticket reuse attacks involve?

View solution

Q. What is the term for a situation where an attacker modifies a URL argument to retrieve unauthorized information in an application?

View solution

Q. In the context of web applications, what is the purpose of the ".." operator in a file path?

View solution

Q. How does a directory traversal attack work?

View solution

Q. What is the potential risk of a successful directory traversal attack on a web server?

View solution

Q. How can developers prevent insecure direct object references in their web applications?

View solution

Q. What role does the ".." operator play in a directory traversal attack URL?

View solution

Q. What is the purpose of the DirBuster tool in penetration testing?

View solution

Q. How does an insecure direct object reference differ from a directory traversal attack?

View solution

Q. Why is it crucial for web applications to implement authorization checks, even if they retrieve information based on user-provided input?

View solution

Q. What is the potential consequence of an insecure direct object reference vulnerability in a web application?

View solution

Q. What is the key difference between local file inclusion attacks and remote file inclusion attacks?

View solution

Q. How can an attacker execute arbitrary code in a file inclusion attack?

View solution