2

I am preparing for a technical interview for an AppSec pen-testing position. For those of you that have had AppSec positions, what sharp-shooter questions do you think I can expect? What questions would you ask a candidate if you were doing the interview? Thank you for your insight!

Improve this question
2
  • I would expect questions around detecting and exploiting different types of injection flaws
    – wireghoul
    Jun 29, 2015 at 1:34
  • 1
    XSS, CSRF, SQLi, Same Origin Policy etc would be on top of my list as well as CORS.
    – racec0ndition
    Jun 29, 2015 at 6:12

3 Answers 3

Reset to default
1

What different types of XSS are there? How are they exploited? How would you remediate them?

Also answer the above 3 questions for SQL injection and Cross site request forgery.

What type of vulnerabilities are hard to detect with automated scanners? How would you manually test these vulnerabilities?

It would be difficult to BS your way through an appsec interview unless the person interviewing you is clueless, or they are willing to take on somebody with little experience.

Not trying to be rude, just a warning. The interviewer can really ask anything as the range of knowledge you have to have is quite extensive.

I don't know how much time you have but I would recommend "The Web Application Hackers Handbook." It is very in depth.

Improve this answer
5
  • How should you store passwords in a database? How would you check for access control flaws? Which versions of SSL and TLS are secure at this point in time? How would you check for session token entropy? Write some pseudocode to automate XSS detection.
    – user3632719
    Jun 29, 2015 at 3:26
  • Thank you for the information. I'll check out the book you recommended.
    – user1722919
    Jun 29, 2015 at 6:15
  • I'm downvoting you because I think the ability to regurgitate definitions demonstrates a poor understanding of security. It's the equivalent of giving a vocabulary test to a writer. It's too specific, and can easily be memorized.
    – Steve Sether
    Jun 29, 2015 at 19:22
  • That is fine that you are downvoting. He asked which questions should he expect. From my experience this is common. Also, I added in questions like how he would check for session token entropy , access control, and write pseudocode to automate XSS detection which clearly have nothing to do with memorization. AND I put in a disclaimer saying that it will be hard to BS your way through an interview with somebody that knows what hes talking about. Whatever floats your boat though.
    – user3632719
    Jun 30, 2015 at 1:07
  • 1
    @SteveSether I'm not seeing definition questions in his answer; these questions require an understanding of the subject matter and are completely valid.
    – Scott C Wilson
    Nov 9, 2015 at 18:20
3
  • What are some strategies to detect and prevent vulnerabilities introduced by third party libraries?
  • How would you demonstrate to a customer why it is important to fix reflective cross-site scripting flaws?
  • How would you demonstrate to a customer why MD5 is not appropriate algorithm to use when hashing passwords?
  • What scripts or tools have you written to assist you in pen-testing applications?
  • How would you advise a customer to fix a CSRF issue that you found?
  • How would you get around a web application firewall that is blocking your attacks against a vulnerable application?
  • Your customer hasn't noticed any of your intrusion attempts. What would you advise?
Improve this answer
1

You can ask about Owasp top 10 vulnerabilities. As a spesific question you can ask about csrf and xss relation.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .