Cybersecurity Attack Types and Defense Mechanisms: Privilege Escalation, CSRF, Directory Traversal, Hash Collisions, SSL Stripping, Password Attacks

Vertical privilege escalation

An attack where a user gains a higher level of permission than they were authorized for, such as moving from standard user access to administrator/system access

Horizontal privilege escalation

An attack where a user gains unauthorized access to a different user's permissions or data at the same privilege level, rather than gaining higher-level access

Data Execution Prevention (DEP)

An operating system feature that restricts which areas of memory an executable is allowed to run code from, helping block certain exploitation techniques

Memory/address space randomization

A security feature where the operating system randomizes where data is stored in memory each time an application runs, making it harder for an attacker to reliably target a specific memory location

Cross-Site Request Forgery (CSRF / XSRF)

An attack where a victim's already-authenticated browser session is used, without their knowledge, to submit an unauthorized request to a trusted site they are logged into

Anti-forgery token

A cryptographic token included with legitimate web requests that a server checks in addition to authentication, used to defend against CSRF attacks

Directory traversal (../)

A web server misconfiguration or vulnerability that allows an attacker to move outside the intended web directory using sequences like ../, accessing unauthorized files

Birthday attack

An attack based on probability theory showing that finding any two matching values (such as a hash collision) requires far fewer attempts than finding a match to one specific value

Hash collision

When two different pieces of plaintext produce the exact same hash output, which should not occur with a properly designed hashing algorithm

MD5 collision vulnerability

A real-world cryptographic weakness discovered in MD5 in 1996, exploited in 2008 to forge a certificate that appeared legitimately signed by a Certificate Authority

Downgrade attack

An attack that tricks two communicating devices into using a weaker encryption algorithm, or no encryption at all, despite a stronger option being available

SSL stripping

A downgrade attack combined with an on-path attack, where an attacker intercepts a connection and forces the victim to use unencrypted HTTP while maintaining a legitimate encrypted HTTPS connection to the real server themselves

Plaintext password storage

An insecure practice where an application stores usernames and passwords unencrypted, allowing anyone who accesses the file or database to see all credentials immediately

Password spraying

An attack where a small number of common passwords are tried against a large number of different accounts, avoiding account lockouts by keeping attempts per account low

Brute force attack (password)

Systematically trying every possible password combination against a hash until a match is found, which is extremely time-consuming and slowed further by strong hashing and long passwords

Offline brute force attack

A brute force attack performed against a downloaded password/hash file rather than a live login system, removing lockout restrictions and allowing unlimited attempts over unlimited time

Scenario: An attacker exploits a Windows kernel vulnerability to gain SYSTEM-level access, the highest privilege level in Windows. What type of attack is this?

Vertical privilege escalation

Scenario: An attacker exploits a flaw to access User B's files while logged in as User A, without ever gaining administrator rights. What type of attack is this?

Horizontal privilege escalation

Scenario: A victim who is already logged into their bank clicks a malicious link, which silently submits a funds transfer request using their authenticated session, without their knowledge. What attack is this, and what common defense would have prevented it?

CSRF (Cross-Site Request Forgery), defended against with an anti-forgery token

Scenario: A web server log shows a request containing "../../windows/system.ini" appended to a URL. What vulnerability is being probed for?

Directory traversal

Scenario: Researchers demonstrate that two different, nearly identical plaintexts produce the exact same MD5 hash, later using this flaw to forge a fraudulent CA-signed certificate. What is this vulnerability called?

Hash collision (MD5 collision vulnerability), related to the birthday attack concept

Scenario: An attacker sitting in the middle of a connection intercepts a redirect to HTTPS, keeps a legitimate encrypted connection to the real server for themselves, but sends the victim only unencrypted HTTP. What attack is this?

SSL stripping (a downgrade attack combined with an on-path attack)

Scenario: An attacker tries only the 3 most common passwords against thousands of different accounts, rather than many passwords against one account, to avoid triggering lockouts. What is this technique called?

Password spraying

Scenario: An attacker downloads a stolen password hash file and runs unlimited guesses against it for weeks with no risk of lockout. What type of attack is this, and why is it more dangerous than attacking a live login page?

Offline brute force attack; more dangerous because there is no lockout mechanism to limit attempts