WGU D385 study Guide (MPC)

200 OK

The request was successful and the server returned the requested data

201 Created

The request was successful and a new resource was created

302 Found

The requested resource was temporarily moved

400 Bad Request

The server cannot process the request due to invalid syntax or missing or malformed data

401 Unauthorized

The request lacks valid authentication credentials

403 Forbidden

The client is authenticated but does not have permission to access the resource

404 Not Found

The requested resource does not exist on the server

405 Method Not Allowed

The endpoint exists but does not support the HTTP method used

500 Internal Server Error

The server encountered an unexpected condition and failed

503 Service Unavailable

The server is temporarily unavailable due to overload or maintenance

401 vs 403

401 means authentication failed or missing while 403 means authenticated but not authorized

400 vs 404

400 means malformed request while 404 means the resource does not exist

404 vs 405

404 means endpoint missing while 405 means endpoint exists but method is wrong

400 Bad Request example

Missing required JSON fields or wrong data type in a requests.post call

401 Unauthorized example

Authorization header missing or token expired in a requests.get call

403 Forbidden example

Valid token but user role lacks permission

404 Not Found example

Requesting a resource ID that does not exist

405 Method Not Allowed example

Sending DELETE to a POST-only endpoint

500 Internal Server Error example

Backend exception raised during request processing

503 Service Unavailable example

Server overloaded or under maintenance

Accept header

Specifies what content types the client can accept

Content-Type header

Specifies the format of the data being sent or returned

Authorization header

Contains credentials such as API keys or bearer tokens

User-Agent header

Identifies the client software making the request

Server header

Reveals server software and can leak information

Strict-Transport-Security header

Forces browsers to use HTTPS only

SQL Injection

An attack that manipulates SQL queries through unsanitized user input

SQL injection vulnerable code

Using string concatenation or f-strings in SQL queries

SQL injection secure code

Using parameterized queries with placeholders

ORM SQL injection risk

Raw SQL with string interpolation bypasses ORM protections

Command Injection

An attack where attacker executes OS commands via user input

Shell Injection

A type of injection using shell metacharacters

eval vulnerability

eval executes user input as code and enables code injection

exec vulnerability

exec executes dynamic code and is dangerous

os.system vulnerability

Executes shell commands using user input

subprocess shell=True risk

Allows command chaining and injection

Command injection mitigation

Use allowlists and avoid shell execution

Cross Site Scripting XSS

An attack that executes malicious scripts in a victim's browser

Reflected XSS

Malicious script is reflected immediately in HTTP response

Stored XSS

Malicious script is stored and later executed by users

DOM-based XSS

Injection occurs in browser JavaScript

XSS vulnerable code

Directly outputting user input into HTML

XSS mitigation output escaping

Escaping HTML characters before rendering

XSS defense in depth

Input validation plus output escaping plus headers

Cross Site Request Forgery CSRF

An attack that tricks a user into sending unintended requests

CSRF vulnerable condition

No CSRF token validation

CSRF mitigation token

Server-generated token validated on POST requests

SameSite cookie

Helps mitigate CSRF by restricting cross-site cookies

Log Injection

An attack that injects malicious content into application logs

Log injection vulnerable code

Logging unsanitized user input

Log injection mitigation

Sanitize outbound log messages

CRLF injection

Manipulating logs using newline characters

Broken Access Control

A vulnerability allowing users to access unauthorized resources

Broken Object Level Authorization BOLA

Accessing objects by changing object IDs

Privilege escalation

Gaining higher permissions than intended

Access control mitigation

Enforce ownership and role checks

Insecure Deserialization

Deserializing untrusted data allowing code execution

pickle vulnerability

pickle.loads on untrusted data enables RCE

Cookie deserialization risk

Serialized cookies can be forged

Deserialization mitigation

Validate data with HMAC and avoid pickle

Sensitive Data Exposure

Leaking confidential data such as passwords or tokens

Sensitive logging risk

Logging passwords or secrets

Sensitive data mitigation

Hash and never store plaintext credentials

Hashing

One-way function for integrity and password storage

Cryptographic hash requirements

Preimage resistance and collision resistance

Safe hash algorithms

SHA-2 SHA-3 BLAKE2

Unsafe hash algorithms

MD5 and SHA-1

Salting

Adding randomness to hashes to prevent rainbow table attacks

Salt vs key

Salt is not secret while key is secret

Key Derivation Function KDF

Slow hashing for password security

PBKDF2

A password hashing KDF

bcrypt

A slow adaptive password hashing function

scrypt

A memory-hard password hashing function

HMAC

Keyed hashing for integrity and authentication

HMAC use case

Protects against tampering and replay

Encryption

Converts plaintext to ciphertext for confidentiality

Symmetric encryption

Uses same key for encryption and decryption

Asymmetric encryption

Uses public and private key pair

AES

A symmetric encryption standard

RSA

An asymmetric encryption algorithm

ECC

Elliptic Curve Cryptography with smaller keys

ECB mode

Insecure mode revealing patterns

CBC mode

Secure mode using IV

GCM mode

Provides confidentiality and integrity

Initialization Vector IV

Random value used with encryption and not secret

Digital signature

Provides integrity authentication and non-repudiation

Digital signature purpose

Not used for confidentiality

TLS

Secure protocol for network communication

TLS handshake

Negotiates cipher suite key exchange and authentication

Diffie-Hellman

Secure key exchange method

TLS uses symmetric encryption

Faster after handshake

X.509 certificates

Standard for public key certificates

RFC 5280

Defines X.509 certificate structure

verify=False risk

Disables server authentication and enables MITM

HSTS

Forces HTTPS and prevents downgrade attacks

Man in the Middle MITM

Attacker intercepts communication

MITM mitigation

TLS HSTS certificate validation

Replay attack

Reusing valid requests or tokens

Replay mitigation

Nonces timestamps token invalidation

Session ID

Unique identifier for user session