📘 Security Testing Interview Guide (With Definitions & Examples)

🔹 1. Networking & Protocols

Term Definition Example
OSI Model (7 Layers) Conceptual model .
Layers: 1️⃣ Physical (Cables, NICs) 2️⃣ Data Link (Ethernet, MAC)
3️⃣ Network (IP, Routing)
4️⃣ Transport (TCP/UDP)
5️⃣ Session (Communication mgmt.)
6️⃣ Presentation (Data translation, SSL/TLS, Encoding)
7️⃣ Application (HTTP, FTP, SMTP). When you browse a website:
• App Layer → HTTP request
• Trans Layer → TCP segments
• Network → IP packets
• Data Link → Ethernet frames
• Physical → bits over cable.
TCP/IP Model (4 Layers) Practical model used in the internet.
Layers:
1️⃣ Network Interface (Ethernet, Wi-Fi)
2️⃣ Internet (IP, ICMP)
3️⃣ Transport (TCP, UDP)
4️⃣ Application (HTTP, FTP, DNS). Sending an email → SMTP over TCP (Application),
TCP segments (Transport), IP packets (Internet), Ethernet (Network Interface).
HTTP Methods Four main methods used in web requests: GET – retrieve data. POST – send data to server. PUT – update existing resource. DELETE – remove a resource. Example:
GET /profile → view profile
POST /login → submit credentials
PUT /user/123 → update user info
DELETE /user/123 → delete user.
Common Ports Network services listen on specific ports. Examples: 21 (FTP), 22 (SSH), 23 (Telnet), 25 (SMTP), 53 (DNS), 80 (HTTP), 110 (POP3), 143 (IMAP), 443 (HTTPS), 3306 (MySQL), 3389 (RDP), 445 (SMB). Access command examples:
ftp 192.168.1.10 (port 21)
ssh [email protected] (port 22)
telnet 192.168.1.10 23 nc -nv 192.168.1.10 445

🔹 2. Data Protection (Encoding, Encryption, Hashing)

Term Definition Example
Encoding Converting data into a different format for compatibility, not security. Reversible. Common Types: • Base64 • ASCII • URL Encoding (%20 = space). String "Hello" → Base64 = "SGVsbG8=".
ASCII → 7 bit encoding (english only)
UTF-8 → standard encoding for web
UTF16/32 → unicode encoding (used internally in windows, java)
Encryption Securing data so only authorized parties can read it. Reversible with a key.
Types: • Symmetric (same key for encrypt/decrypt) → AES, DES, 3DES.
• Asymmetric (public/private key) → RSA, ECC(elliptic curve cryptography).
• Hybrid (TLS uses RSA + AES). If Alice encrypts with Bob’s public key, only Bob can decrypt with his private key (RSA).
Hashing One-way transformation of data into a fixed-length digest. Not reversible. Algorithms:
• MD5 (128-bit, outdated)
• (secure hash algorithm) SHA-1 (160-bit, weak)
• SHA-256 (secure, widely used). Password "admin123" → SHA256 = c7ad44cbad....

🔹 3. Threat Modeling

Model Definition Example
STRIDE Categorizes threats:
S – Spoofing
T – Tampering
R – Repudiation
I – Information Disclosure
D – Denial of Service
E – Elevation of Privilege. Web app login → Spoofing = fake login Tampering = modifying DB entries DoS = login brute-force.
DREAD Risk scoring model (0–10 each):
D – Damage potential
R – Reproducibility
E – Exploitability
A – Affected users
D – Discoverability. SQL Injection: Damage=10, Reproducibility=10, Exploitability=9, Users=10, Discoverability=9 → Very High Risk.

🔹 4. Security Testing Methodology (PTES)

Step Definition Example
1. Pre-engagement Define scope, rules of engagement. Decide if test is black-box/white-box.
2. Intelligence Gathering Reconnaissance, scanning. Subdomain discovery using subfinder.
3. Threat Modeling Identify potential attack vectors. Login form → risk of SQLi, brute-force.
4. Vulnerability Analysis Find flaws in systems. Run nmap --script=vuln.
5. Exploitation Actively exploit vulnerabilities. Use sqlmap to dump DB.
6. Post-Exploitation Maintain access, privilege escalation. Use Meterpreter session.
7. Reporting Document findings with impact + fixes. Write risk report with screenshots.

🔹 5. Web Application Security

Term Definition Example
SQL Injection (SQLi) Injecting SQL queries to manipulate DB. Types: • In-band (direct results shown) • Blind (Boolean/Time-based) • Error-based (error messages leak info). Login bypass: admin' OR '1'='1.
Cross-Site Scripting (XSS) Injecting malicious JS into a site. Types: • Reflected (in URL params) • Stored (saved in DB) • DOM-based (client-side). <script>alert(1)</script>.
CSRF Tricks a user into performing actions on another site without consent. Attacker sends <img src="<http://bank.com/transfer?amt=1000&to=attacker>">.
IDOR (Insecure Direct Object Ref.) Accessing objects by changing identifiers without proper authorization. URL: /user/123/profile → change to /user/124/profile.

🔹 6. Tools

Tool Use Case Example
Burp Suite Proxy for intercepting/modifying HTTP requests, scanning vulnerabilities. Use “Repeater” to test SQLi on login form.
OWASP ZAP Open-source web scanner. Scan Types: Quick, Active, Passive. Can generate SSL certs to decrypt HTTPS traffic. Use ZAP as a proxy to see HTTPS requests.
Postman API testing tool. Send requests, test auth (OAuth/JWT), validate responses. Send POST /api/login with JSON payload.
OpenVAS Vulnerability scanner. 4 Functions: Scanning, Reporting, False-positive mgmt, Asset discovery. Scan 192.168.1.10 for missing patches.