Expected question in Application security interview.

What is HTTP request smuggling?

HTTP request smuggling is a technique for interfering with the way a web site processes sequences of HTTP requests that are received from one or more users. Request smuggling vulnerabilities are often critical in nature, allowing an attacker to bypass security controls, gain unauthorized access to sensitive data, and directly compromise other application users.

What is web cache deception?

Web cache deception (WCD) is an attack proposed in 2017, where an attacker tricks a caching proxy into erroneously storing private information transmitted over the Internet and subsequently gains unauthorized access to that cached data.

Explain DOM XSS? Can DOM XSS be stored? Can CSP header mitigate dom based XSS?

DOM Based XSS ("Document Object Model-based Cross-site Scripting"). DOM is an application programming interface (API) for HTML and XML documents. 

DOM-based XSS vulnerabilities usually arise when JavaScript takes data from an attacker and passes it to a sink that supports dynamic code execution, such as eval() or innerHTML. This enables attackers to execute malicious JavaScript, which typically allows them to hijack other users' accounts.

Yes, DOM XSS can be stored. The most damaging type of XSS is Stored XSS. Stored DOM-based vulnerabilities arise when user input is stored and later embedded into a response within a part of the DOM then processed in an unsafe way by a client-side script. An attacker can leverage the data storage to control a part of the response (for example, a JavaScript string) that can be used to trigger the DOM-based vulnerability.

Content Security Policy (CSP) is a browser security mechanism that aims to mitigate XSS and some other attacks. It works by restricting the resources (such as scripts and images) that a page can load and restricting whether a page can be framed by other pages.

To enable CSP, a response needs to include an HTTP response header called Content-Security-Policy with a value containing the policy.

What will be your test case for a file upload functionality?

What is HSTS?

Explain SSL Stripping?

If you have API calls which need to fetch credentials, what will be the secure way to store secrets and making them available for API calls?

Do the HttpOnly cookie and X-XSS-Protection header mitigate cross-site scripting attacks?

Differences : IDOR, Missing function level access control and privilege escalation?
How does burp suite work with HTTPs requests?

How does ssh authentication work?

Explain SDLC?
In which phase of SDLC should security be integrated?
What is salt in cryptography?
What is Double-Submit Cookie?
What is Preflight request?
Explain CORS and SOP?
Explain SSL Handshake?
Explain a DOM-based cross-site scripting attack.
Is input validation sufficient to prevent cross-site scripting?
Explain a blind SQL injection attack.
How does a web application firewall (WAF) detect and prevent attacks?
What is the difference between authentication and authorization?
What is same origin policy? What is CORS (cross-origin resource sharing)?
You have a log-in page with “username” and “password” fields. How do you test for SQL injection without using any tool?
Which is your favorite security tool and why?
What is the most interesting vulnerability you’ve found?
How does gmail.com ensure that some hacker on the internet is not reading my emails while Gmail pushes the emails out to me? Listen for an explanation of SSL/TLS, man-in-the-middle attacks, and how to prevent them.
Tell me about a recent security breach that caught your attention and why?

What are the tools used in Web, network, thick client, api for vulnerability assessment and penetration testing?

What is SSRF? what can you achieve on extent level of exploitation?

what is second order SQL injection? what is your approach if you find it?

what is OAuth and different version of OAuth?

What is CI/CD and tools used in CI/CD?

What is HPP?

Explain Nmap scripts that you have used in your project and purpose?

Differences between http 1.0 vs 2.0 and how do you perform testing?

APK reverse engineering mitigation and how do you achieve that?

Do you have any scripting experience?

what is 3 way handshake?

If application doesn't use secure flag how can you provide POC for exploitation?

what is Metasploit?

What is Honeypot? How do you know that you are performing vulnerability check on Honeypot?