Web AppSec interview questions every company should ask

So you’re looking to hire a new web application security team member. You’ve found a promising entry or midlevel candidate (depending on the position you’re looking to fill) with a suitable professional background. During the phone screening, they claim to have a ninja-level knowledge of security, and they seem ready to dodge any curveballs you might throw their way. Is that so? As the interviewer, you’re thinking, “Challenge accepted!”

You decide to bring this confident, enthusiastic candidate in for an interview. But there are so many topics to cover! Where do you begin? This handy list of web application security interview questions will get you started.

1. Basic website and IT questions

Start the interview by making sure the candidate understands how websites and applications work in general. Here, you’re probing to see whether they understand protocols, networking layers, browsers, servers, databases, data at rest, data in transit, and the like. Here are a few classic interview questions to assess their understanding of these topics:

Question: Explain what happens when you enter “google.com” in a browser’s address bar. This is a very open-ended question. The right answer varies per the job requirements. But in general, the candidate should have a fair understanding of DNS, DHCP, ARP, TCP and SSL/TLS handshakes, proxy, cookies, session management, HTTP methods, GET/POST, and so on.

Question: Are you a Mac/Windows/Linux person? Which OS is most secure? Trick question! No OS is completely secure. A lot depends on how it’s patched, configured, and managed. You can ask follow-up questions on OS hardening, patching, configuration management, and so on.

2. Network security questions

Now that we’ve covered the basics, let’s establish an understanding of the candidate’s network security knowledge.

The candidate has probably been throwing out various network terminology. Now might be a good time to ask, “So how would you hack it?” Skills in network security are essential for an astute application security professional. The candidate should know about common exploits and remediation related to networks. Here are some relevant network security interview questions:

Question: How would you perform a network reconnaissance? Here, you’re looking for awareness of basic tools and network commands—namely nmap, nessus, ping, traceroute, nslookup, and so on.

Scenario: You’re a web administrator for HandlingMoreTrafficThanFacebook.com. How do you prevent a DDoS attack on the website? This could be a stress question, especially if the candidate does not have a networking or admin background. All you’re looking for here is a basic understanding of how networks work and what can be done to prevent unsolicited requests to your website—using things such as throttling, load balancers, smart firewalls, bandwidth flexibility, third-party content delivery network providers, and so on.

Scenario: You’re sitting at a Starbucks enjoying a macchiato and free public Wi-Fi. How do you go about hacking other people on the network? You’re asking the candidate to think like an attacker. You’re looking for a well-thought-out approach and things like packet sniffing (Wireshark), man-in-the-middle attacks (like the WPAD attack), eavesdropping on unencrypted data, Metasploit framework and tools, and so on.

3. Web application security questions

Without any further ado, let’s proceed to the core challenge.

Now is the time to ask some OWASP Top 10 questions to test your candidate’s knowledge of common web-based attacks. Attacks include SQL injection, XSS (cross-site scripting), CSRF (cross-site request forgery), directory traversal, LDAP/XML/command injection, clickjacking, remote file inclusion, remote code execution, buffer/integer/heap overflows, and so on. You could formulate hundreds of specific web AppSec questions. But since you have limited time to assess the candidate, consider questions that show you their thought process:

Question: Which approach is better: a manual security test or an automated security test? Short answer: It depends. Long answer: We don’t have a clear winner, so the candidate should compare the pros and cons of both and describe a balanced approach.

Question: What is the difference between white box and black box testing? Which is better? Trick question, especially the “which is better” part. The answer depends on a host of factors such as cost, time, the team’s requirements, code availability, stage of the SDLC, and so on.

Question: How would you perform a security/penetration test on a web application covering the following scenarios?

• Unauthenticated tests on log-in page. Test for brute forcing, password cracking, rainbow table attacks, account lockouts, clickjacking, session fixation, and so on.
• Authenticated tests with one user account. Test for the usual suspects from the OWASP Top 10.
• Authenticated tests with multiple user accounts. Test for horizontal privilege escalation, vertical privilege escalation, and forceful browsing.

Question: Explain a DOM-based cross-site scripting attack.

Question: Is input validation sufficient to prevent cross-site scripting?

Question: Explain a blind SQL injection attack.

Question: How does a web application firewall (WAF) detect and prevent attacks?

Question: What is the difference between authentication and authorization?

Question: What is same origin policy? What is CORS (cross-origin resource sharing)?

4. Questions about web AppSec tools and practical knowledge

Next, assess the candidate’s familiarity with tools and hands-on experience. There is no precise list of tools, but knowledge of some common ones (such as proxies, packet sniffers, network reconnaissance/monitoring/capturing tools, and fuzzers) is always a plus. Here are some sample questions about web AppSec tools and practical knowledge to consider:

Question: Have you taken part in a bug bounty or CTF contest?

Question: Which is your favorite security tool and why?

Question: What is the most interesting vulnerability you’ve found?

Scenario: You have a log-in page with “username” and “password” fields. How do you test for SQL injection without using any tool?

5. Cryptography questions

Knowledge of basic practical cryptography is a must for any good security professional. The candidate should understand how sensitive data is protected at rest and in transit. They should also know about common cryptographic attacks and prevention. Here are some cryptography interview questions to test this knowledge:

Question: What is the difference between encryption, encoding, and hashing? It’s better if the candidate can explain with some example algorithms.

Question: What is the difference between asymmetric and symmetric cryptography? You can ask follow-up questions on example algorithms, key exchange, performance, usage, and so on.

Question: Why is the word “password” a bad password? You’re testing the candidate’s understanding of password storage and password brute forcing. Listen for concepts such as password crackers, rainbow tables, dictionary attacks, hashing, and salting.

Question: How does gmail.com ensure that some hacker on the internet is not reading my emails while Gmail pushes the emails out to me? Listen for an explanation of SSL/TLS, man-in-the-middle attacks, and how to prevent them.

6. Coding questions

You may be thinking, “Wait, what? Why coding? Isn’t this supposed to be a web application security interview?” But a security professional might have to perform secure code review or write automation scripts, so it’s important to check for this skill. Level of depth, however, depends on the position. These questions will help you gather more information on the candidate’s coding knowledge and experience.

Question: What is the last/biggest/best program you wrote?

Question: What is your programming language of choice and why?

Question: Have you written a program to generate a new programming language? You might expect an answer like “Thanks for interviewing me. I will seek employment elsewhere.” Just kidding! The idea is that the difficulty level of your programming questions should depend on the job requirement.

7. Questions about other application security topics

Software security is not limited to web application security. Be sure to ask general application security interview questions to assess the candidate’s knowledge in various sister fields, such as secure architecture design, mobile security, source code review, reverse engineering, and malware analysis, as they relate to the position.