Web vulnerability scanning in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is web vulnerability scanning?

Web vulnerability scanning is the automated process of checking websites or web applications for security weaknesses that attackers could exploit.

beginner

Name two common types of vulnerabilities that web scanners look for.

Common vulnerabilities include SQL Injection, where attackers manipulate database queries, and Cross-Site Scripting (XSS), where attackers inject malicious scripts into web pages.

beginner

Why is it important to regularly perform web vulnerability scanning?

Regular scanning helps find new security issues early, so they can be fixed before attackers exploit them, keeping websites and user data safe.

intermediate

What is the difference between authenticated and unauthenticated scanning?

Authenticated scanning means the scanner logs in to the web application to check deeper areas, while unauthenticated scanning checks only public parts without logging in.

intermediate

How can false positives affect web vulnerability scanning results?

False positives are when the scanner reports a problem that isn’t really a vulnerability, which can waste time and resources investigating non-issues.

What does a web vulnerability scanner primarily do?

A Improves website design

B Checks websites for security weaknesses

C Increases website speed

D Creates new web pages

Web vulnerability scanners look for security weaknesses that could be exploited by attackers.

Which vulnerability involves injecting malicious scripts into web pages?

A SQL Injection

B Denial of Service

C Phishing

D Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) allows attackers to inject harmful scripts into web pages viewed by other users.

What is a benefit of authenticated scanning over unauthenticated scanning?

A It scans only public pages

B It requires no login credentials

C It can check protected areas of a website

D It runs faster

Authenticated scanning logs into the web app to check areas not visible to the public.

Why should web vulnerability scanning be done regularly?

A To find and fix new security issues early

B To improve website graphics

C To increase website traffic

D To update website content

Regular scanning helps detect new vulnerabilities before attackers can exploit them.

What is a false positive in web vulnerability scanning?

A A reported issue that is not actually a problem

B A vulnerability that is ignored

C A real security threat

D A successful attack

False positives are scanner alerts about problems that do not actually exist.

Explain what web vulnerability scanning is and why it is important.

Think about how scanning helps keep websites safe from attackers.

Describe the difference between authenticated and unauthenticated web vulnerability scanning.

Consider whether the scanner has access to protected parts of the website.