Expected question in Application security interview.

What is HTTP request smuggling?

HTTP request smuggling is a technique for interfering with the way a web site processes sequences of HTTP requests that are received from one or more users. Request smuggling vulnerabilities are often critical in nature, allowing an attacker to bypass security controls, gain unauthorized access to sensitive data, and directly compromise other application users.

What is web cache deception?

Web cache deception (WCD) is an attack proposed in 2017, where an attacker tricks a caching proxy into erroneously storing private information transmitted over the Internet and subsequently gains unauthorized access to that cached data.

Explain DOM XSS? Can DOM XSS be stored? Can CSP header mitigate dom based XSS?

DOM Based XSS ("Document Object Model-based Cross-site Scripting"). DOM is an application programming interface (API) for HTML and XML documents. 

DOM-based XSS vulnerabilities usually arise when JavaScript takes data from an attacker and passes it to a sink that supports dynamic code execution, such as eval() or innerHTML. This enables attackers to execute malicious JavaScript, which typically allows them to hijack other users' accounts.

Yes, DOM XSS can be stored. The most damaging type of XSS is Stored XSS. Stored DOM-based vulnerabilities arise when user input is stored and later embedded into a response within a part of the DOM then processed in an unsafe way by a client-side script. An attacker can leverage the data storage to control a part of the response (for example, a JavaScript string) that can be used to trigger the DOM-based vulnerability.

Content Security Policy (CSP) is a browser security mechanism that aims to mitigate XSS and some other attacks. It works by restricting the resources (such as scripts and images) that a page can load and restricting whether a page can be framed by other pages.

To enable CSP, a response needs to include an HTTP response header called Content-Security-Policy with a value containing the policy.

What will be your test case for a file upload functionality?

What is HSTS?

Explain SSL Stripping?

If you have API calls which need to fetch credentials, what will be the secure way to store secrets and making them available for API calls?

Do the HttpOnly cookie and X-XSS-Protection header mitigate cross-site scripting attacks?

Differences : IDOR, Missing function level access control and privilege escalation?
How does burp suite work with HTTPs requests?

How does ssh authentication work?

Explain SDLC?
In which phase of SDLC should security be integrated?
What is salt in cryptography?
What is Double-Submit Cookie?
What is Preflight request?
Explain CORS and SOP?
Explain SSL Handshake?
Explain a DOM-based cross-site scripting attack.
Is input validation sufficient to prevent cross-site scripting?
Explain a blind SQL injection attack.
How does a web application firewall (WAF) detect and prevent attacks?
What is the difference between authentication and authorization?
What is same origin policy? What is CORS (cross-origin resource sharing)?
You have a log-in page with “username” and “password” fields. How do you test for SQL injection without using any tool?
Which is your favorite security tool and why?
What is the most interesting vulnerability you’ve found?
How does gmail.com ensure that some hacker on the internet is not reading my emails while Gmail pushes the emails out to me? Listen for an explanation of SSL/TLS, man-in-the-middle attacks, and how to prevent them.
Tell me about a recent security breach that caught your attention and why?

What are the tools used in Web, network, thick client, api for vulnerability assessment and penetration testing?

What is SSRF? what can you achieve on extent level of exploitation?

what is second order SQL injection? what is your approach if you find it?

what is OAuth and different version of OAuth?

What is CI/CD and tools used in CI/CD?

What is HPP?

Explain Nmap scripts that you have used in your project and purpose?

Differences between http 1.0 vs 2.0 and how do you perform testing?

APK reverse engineering mitigation and how do you achieve that?

Do you have any scripting experience?

what is 3 way handshake?

If application doesn't use secure flag how can you provide POC for exploitation?

what is Metasploit?

What is Honeypot? How do you know that you are performing vulnerability check on Honeypot?

What will you do after receiving Purple Screen of Death Error (PSOD)?

I'll connect to ILO\IDRAC\KVM depends on the HW model and will check the screen status on the console

I'll try to rebooting ESXi node. In the mean time I will check how VM's were rebooted by HA and will check the status of those VM's if they are in accessible or not.  

Meantime I will keep the ESXi node in Maintenance mode and raise a case with Vendor to fix the HW issues if there is any.

How do you perform ESXi upgrade from 6.5 to 6.7?

I will check the HW compatibility first whether it supports the ESXi OS or not

Downloaded the installation bundle from VMware site 

Upload the ESXi  ISO  image to the Datastore and I will create baseline in Update Manager.

Now keep ESXi host in maintenance mode.

After all VMs migrated to another host I will start updating the firmware 

After firmware is updated I will start the ESXi upgrade from VUM

from VUM I will attach the baseline  and remediate.

After its upgraded to 6.7  validate all the network\DS\vnics , and remove the Esxi from MM.

How do you troubleshoot performance related issues of ESXi?

I will log into the ESXi and check what processes or services utilizing more recourses. If I find any system processes utilization is abnormal I try to reboot the ESXi node and see if the performance issue is resolved. If the issue is still abnormal I'll open a case with VMware.

If  VM's are utilizing more resources in the cluster I will try to migrate few VM's from cluster to another cluster. 

How to troubleshoot network issues?

I'll check the cutsheet of the server and check which port is connected to which NIC.

Request Datacenter team to check whether the n/w cable has any cuts or SFP is properly working or not or is there any brakes to the pin.

If there is any issues with above cases then exchange the parts otherwise we will check whether it is a hardware issue means adopter is properly working or not.

It is issues with this then replace the adopter and check it is working or not. 

If it is ok, then issue solved otherwise we will raise a case with network team.

How do you fix network issues in VM?

I will check any recent changes performed on those VMS.

I will check any glitches or network errors on VOBD logs, from the logs I can see, it can be a hardware issue or VM level issue.

If it is a hardware issue I will go with vendor case and try to replace the NIC Adopters or SFP Modules.

If it is a VM level issue, I will check from port level, Is there any issue with it like any recent IP Changes or configuration changes.

Later I tried to migrate one VM to the next host and check the status of VM network, 

still it is not resolved I will engage with network team and ask them to check from network level, 

still network team also not resolved the issue, I will raise the VM ware case to check any bugs cause the issue.

Datastore high utilization troubleshoot and fix?

Upon checking the Datastore will verify the Datastores were connected with the clusters and look for any errors in it.

If the Datastore is high utilized , check for which VMs consume high data utilization and try to migrate the next DS available in same cluster. 

I will use scripts to get the snapshot files details first, if i found more snapshots will inform to os team to delete it.

If the particular Database having only single VM and its only utilizing high then split the VMDK files and balance the DS utilization

if the total Datastore in cluster are high then try to migrate vm by choose both live vmotion and svmotion option of few vm's from source to available datastores and recourses in different cluster if EVC enabled

if EVC not enabled and DS in fatal condition i will get the downtime from app team and migrate the few vs to free up the space in DS and last and final thing will req to add more storage on cluster

VMWare converter:

linux server migration :

First do the vlan validation and vlan trunking and Port group creation need to be done on destination VC for the vm's we are going to migrate

Ports need to be enable by taking help from network team for jump servers

get the free ip of vm

set the local root account

open vmware converter and login to the vm by using ip adress and provide the destination vc\ds\network details

later provide the free ip\subnet\gateway\dns details in ipv4

then submit the request

once it migrated, configure the eth files and reboot the server

once it comes online inform os and app team for post validations

*****************************

Windows server:

for windows we don't req free ip

set -local admin account and provide the destination vc, ds and network details. 

and submit the req once the migration done, vm will come online

********************************

Steps for HCX migration?

Install the sential agent on all the migrating servers before start the activity

set the local root account

login to hcx manager tool and from choose the required option like

cluster\ds\network\os assisted migration and submit the job

wait till the migration completes

after the migration

power off the vm and register the vm in destination vc

assign vlan and power it on and do the ip setting

later do the svmotion and give the handover to app and os team for validations.

incase of vm fails, power off the vm from vc and delete and power it on from the source location.

DS disconnect or not available or inaccessible

first need to identify weather its NAS or SAN

if it is NAS i will try to ping the ip of the NAS from ESXi if its not reachable, i will request network team to check the issue mean while i will verify the hw end.

SAN - i will reach out storage team to rectify the issue parallelly raise an vmware and work with them also and i will verify the HW end