ISF Logs

The attacker forges ARP replies that map a victim's IP address to the attacker's MAC, so traffic on the local network gets delivered to the attacker instead. * Forged ARP replies route victim↔router traffic through the attacker — a LAN man-in-the-middle. * ARP (Address Resolutio...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

Both are plain text: a first line, header fields (one per line), a blank line, then an optional message body. * Request and response share one four-part text structure — which is why anything in the middle can parse and forge it. * Part Request Response First line Request...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

Each HTTP request/response is independent — the server has no built-in "memory" linking one request to the next from the same client. Without state, login wouldn't work — every page load would be a stranger. So web apps build state on top of HTTP: The server gives the client a v...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

HPKP let a server pin specific public-key fingerprints — the browser would refuse to trust any other key for that domain for max-age time. In theory: rock-solid defense against rogue CAs issuing fake certs for your domain. In practice: a self-destruct button. Why it was deprecate...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

A person or program pretending to be someone or something else. The category is broad because identity is "soft" almost everywhere on the internet — sender fields, source IPs, MAC addresses, and DNS records are all just claims, not proofs. Variant What gets faked Typical goal...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

GET is for retrieving data and should not change server state; POST is for submitting data and may change state. GET POST Parameters live in URL query string (?id=123&x=y) Request body Has a body? No Yes Cached by browser/proxy Yes No Bookmarkable / linkable Yes No...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

A hidden field is just HTML — the browser will dutifully send back whatever the client edited it to. An attacker can change price=5.50 to price=0.50 with browser dev tools and the server, trusting the value, will bill them 50¢ for the socks. The broken pattern: <input type="hidde...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

The attacker sends a flood of SYN packets with spoofed source IPs; the server reserves a half-open connection for each and waits for an ACK that never comes, exhausting its connection table. * Each spoofed SYN pins a half-open slot; the SYN-ACK goes nowhere and the table fills....

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

The first digit groups them: 2xx success, 3xx redirect, 4xx client error, 5xx server error. Code Meaning When you see it 200 OK Success with body Normal page load 204 No Content Success, no body API DELETE; "saved" with nothing to show 301 Moved Permanently Permanent r...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026

A small text record (name=value plus metadata) the server stores in the browser via Set-Cookie: — the browser automatically sends it back on every matching request. It's the most common way to carry session state (the "ticket" pattern from stateless HTTP). Key attributes: Attr...

Quiz: ISF / Web Application Security Basics | updated: Jul 30, 2026