NetSPI interview question

sql , xss , idor