ISF Logs

A person or program pretending to be someone or something else. The category is broad because identity is "soft" almost everywhere on the internet — sender fields, source IPs, MAC addresses, and DNS records are all just claims, not proofs. Variant What gets faked Typical goal...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

GET is for retrieving data and should not change server state; POST is for submitting data and may change state. GET POST Parameters live in URL query string (?id=123&x=y) Request body Has a body? No Yes Cached by browser/proxy Yes No Bookmarkable / linkable Yes No...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

A hidden field is just HTML — the browser will dutifully send back whatever the client edited it to. An attacker can change price=5.50 to price=0.50 with browser dev tools and the server, trusting the value, will bill them 50¢ for the socks. The broken pattern: <input type="hidde...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

The attacker sends a flood of SYN packets with spoofed source IPs; the server reserves a half-open connection for each and waits for an ACK that never comes, exhausting its connection table. * Each spoofed SYN pins a half-open slot; the SYN-ACK goes nowhere and the table fills....

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

The first digit groups them: 2xx success, 3xx redirect, 4xx client error, 5xx server error. Code Meaning When you see it 200 OK Success with body Normal page load 204 No Content Success, no body API DELETE; "saved" with nothing to show 301 Moved Permanently Permanent r...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

A small text record (name=value plus metadata) the server stores in the browser via Set-Cookie: — the browser automatically sends it back on every matching request. It's the most common way to carry session state (the "ticket" pattern from stateless HTTP). Key attributes: Attr...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

A set of response headers a server uses to deliberately relax the Same-Origin Policy — telling the browser "these specific other origins are allowed to read my responses." * The server's Access-Control-Allow-Origin decides whether the browser lets the calling script read the res...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

The attacker sends small requests with the victim's spoofed IP as the source to many third-party servers, which then flood the victim with their (usually amplified) replies. * Reflection hides the attacker; amplification multiplies the traffic that lands on the victim. * This co...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

HSTS tells the browser "always connect to this site over HTTPS; never accept HTTP" for a period of time. Strict-Transport-Security: max-age=31536000; includeSubDomains max-age=31536000 — remember this rule for 1 year (in seconds). The header must be re-served on each HTTPS visit...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

If session IDs are predictable, an attacker who has any valid ID (their own) can guess everyone else's by incrementing — instantly hijacking other users' sessions. The attack: Attacker logs in legitimately, gets sessionid=0000000042. Attacker swaps in sessionid=0000000043 — now...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026