46.7 Ethical Hacking, OWASP and Kali Lab Questions

Q61. What is ethical hacking?

Authorised testing to find weaknesses before criminals do. Written scope, rules of engagement, and reporting are mandatory. Without permission, the same techniques are cybercrime under laws such as the IT Act in India (verify current sections).

Q62. Name the high-level ethical hacking phases defensively.

Reconnaissance, scanning, gaining access, maintaining access, and covering tracks are taught as attacker phases so defenders know where to place controls and detections. I practise phases only inside my lab and I emphasise logging and hardening at each stage.

Q63. What is the OWASP Top 10 used for?

It is a widely cited awareness document for common web application risks such as injection, broken access control, and security misconfiguration. I use it to prioritise fixes on DVWA/Juice Shop in my lab, not as a legal attack guide.

Q64. How do you explain XSS and its fix?

Cross-site scripting injects attacker script into pages viewed by others. Defence: context-aware output encoding, CSP, validated input, and HttpOnly cookies. I demo stored/reflected types only on OWN Juice Shop/DVWA.

Q65. What is IDOR?

Insecure Direct Object Reference – changing an object id to see another user’s record. Fix is authorisation checks on every object, not only UI hiding. Raja-Rani order IDs must be checked against the logged-in user.

Q66. When do you mention Nmap in an interview?

I say I use Nmap to inventory ports and services on hosts I own, with gentle timing in labs (-T2) and clear scope. I also say Blue uses the same knowledge to know what should be listening.

Q67. How do you talk about sqlmap without sounding reckless?

I state I only ran it against my DVWA/Juice lab to understand detection noise and then I focused on prepared statements so sqlmap-style traffic fails. I do not run sqlmap against third-party sites.

Q68. Burp Suite – what is a safe interview answer?

Burp is an intercepting proxy for analysing HTTP(S) in authorised tests. I use it in lab to see cookies, parameters, and replay requests against OWN apps, then I fix issues in code.

Q69. What is the difference between vulnerability scanning and exploitation?

Scanning identifies potential weaknesses; exploitation proves impact. In many jobs I stop at validated findings with proof-of-concept that stays inside rules of engagement. Unauthorised exploitation is illegal.

Q70. How do you describe a good vulnerability report?

Title, severity, affected asset, steps to reproduce on the in-scope target, impact, and clear remediation. Screenshots from OWN lab portfolio follow the same structure. No dump of unrelated personal data.