212-82 · Question #150
name of the alert with WASC ID 9. (Practical Question)
The correct answer is B. Application Error Disclosure. WASC ID 9 is specifically assigned to the "Application Error Disclosure" alert, which reveals sensitive system information.
Question
name of the alert with WASC ID 9. (Practical Question)
Options
- AAbsence of Anti-CSRF Tokens
- BApplication Error Disclosure
- CViewstate without MAC Signature
- DX-Frame-Options Header Not Set
How the community answered
(33 responses)- A6% (2)
- B88% (29)
- C3% (1)
- D3% (1)
Why each option
WASC ID 9 is specifically assigned to the "Application Error Disclosure" alert, which reveals sensitive system information.
Absence of Anti-CSRF Tokens corresponds to WASC ID 8, which is a different vulnerability related to Cross-Site Request Forgery protection.
WASC ID 9 specifically corresponds to the "Application Error Disclosure" vulnerability, indicating that an application is revealing potentially sensitive error messages, stack traces, or other system information that could aid an attacker. This disclosure provides valuable reconnaissance for adversaries seeking to understand system internals.
Viewstate without MAC Signature corresponds to WASC ID 19, which is a vulnerability specific to ASP.NET applications not properly securing ViewState.
X-Frame-Options Header Not Set corresponds to WASC ID 15, related to Clickjacking protection.
Concept tested: Web Application Security Consortium (WASC) Threat Classification
Source: https://web.archive.org/web/20180214061528/http://projects.webappsec.org/w/page/13246960/WASC%20Threat%20Classification#Application_Error_Disclosure
Topics
Community Discussion
No community discussion yet for this question.