SecPrep — security interview prep

Free spaced-repetition flashcards for security interviews: XSS, CSRF, SQL injection, SSRF, authn vs authz, OAuth/OIDC, TLS, and the behavioral questions that decide senior roles.

• What is the difference between stored and reflected XSS?
• How does CSRF work, and what are the primary defenses?
• Explain the difference between authentication and authorization.
• What is SSRF and why is it especially dangerous in cloud environments?
• What is IDOR / BOLA and how do you prevent it?
• How should an application store user passwords?
• What is the difference between OAuth 2.0 and OpenID Connect?
• Why is reflecting the Origin header with credentials a CORS vulnerability?
• What is Server-Side Template Injection (SSTI)?
• Fill in the OWASP Top 10 (2021) categories.
• Complete the (TLS 1.2) handshake steps.
• Which cookie attribute prevents the cookie from being sent on cross-site requests?