I am preparing for a technical interview for an AppSec pen-testing position. For those of you that have had AppSec positions, what sharp-shooter questions do you think I can expect? What questions would you ask a candidate if you were doing the interview? Thank you for your insight!
What different types of XSS are there? How are they exploited? How would you remediate them?
Also answer the above 3 questions for SQL injection and Cross site request forgery.
What type of vulnerabilities are hard to detect with automated scanners? How would you manually test these vulnerabilities?
It would be difficult to BS your way through an appsec interview unless the person interviewing you is clueless, or they are willing to take on somebody with little experience.
Not trying to be rude, just a warning. The interviewer can really ask anything as the range of knowledge you have to have is quite extensive.
I don't know how much time you have but I would recommend "The Web Application Hackers Handbook." It is very in depth.
- What are some strategies to detect and prevent vulnerabilities introduced by third party libraries?
- How would you demonstrate to a customer why it is important to fix reflective cross-site scripting flaws?
- How would you demonstrate to a customer why MD5 is not appropriate algorithm to use when hashing passwords?
- What scripts or tools have you written to assist you in pen-testing applications?
- How would you advise a customer to fix a CSRF issue that you found?
- How would you get around a web application firewall that is blocking your attacks against a vulnerable application?
- Your customer hasn't noticed any of your intrusion attempts. What would you advise?