13.3: Application Attack Indicators

What is an injection attack?

Any attack that inserts attacker-controlled data into a command, query, or document that a system then executes. The root cause is trusting input as code rather than data.

What is command injection?

Injecting OS shell commands through an application input field so the server executes them with the application's privileges.

What is LDAP injection?

Manipulating an application's LDAP query with crafted input to bypass authentication or retrieve unauthorized directory entries.

What is XML injection, and what is XXE?

XML injection alters an application's XML data or queries. XXE (XML external entity) abuses external entity references to read local files, reach internal systems, or trigger DoS.

What are the indicators of a SQL injection attempt?

Log entries containing SQL syntax or comment characters in input fields, database errors returned to users, abnormally long query times, and unexpected mass record access.

What are the indicators of an XSS attack?

Script tags or encoded script payloads appearing in stored input fields, logs, or URLs; WAF alerts on script patterns; and users reporting unexpected redirects or session loss.

What are the indicators of a buffer overflow attempt?

Repeated application crashes, segmentation faults, abnormally long input strings in logs, and unexpected process behavior or privilege changes after a crash.

What is an integer overflow?

Supplying a value larger than a variable can store, causing it to wrap around to an unexpected value. Can bypass size checks and lead to memory corruption.

What is privilege escalation?

Gaining rights beyond what an account was granted, usually by exploiting a flaw, misconfiguration, or weak permissions.

What is the difference between vertical and horizontal privilege escalation?

Vertical moves to a higher privilege level — user to admin or root. Horizontal moves sideways to another account at the same level to access its data.

What are the indicators of privilege escalation?

New accounts added to privileged groups, unexpected use of admin tools, sudo or runas anomalies, and service accounts performing interactive logins.

What is a forgery attack?

An attack where the attacker fabricates a request, token, or credential so a system accepts it as legitimate.

What is cross-site request forgery (CSRF)?

Tricking an authenticated user's browser into submitting an unwanted request to a site where they're already logged in. Mitigated by anti-CSRF tokens and SameSite cookies.

What is server-side request forgery (SSRF)?

Tricking a server into making requests on the attacker's behalf, reaching internal systems and cloud metadata services that aren't externally accessible.

What is directory traversal?

Using relative path sequences like ../ in input to escape the web root and read files elsewhere on the filesystem, such as /etc/passwd.

What are the indicators of directory traversal?

Dot-dot-slash or encoded equivalents (%2e%2e%2f) appearing in URLs and request logs, and access attempts to system files outside the application directory.

What is an API attack?

Abusing an application's API through missing authentication, broken object-level authorization, excessive data exposure, or lack of rate limiting.

What is resource exhaustion as an application attack?

Deliberately consuming an application's memory, connections, threads, or disk until it becomes unresponsive — an application-layer denial of service.

What is a memory leak, and why does it matter for security?

An application failing to release memory it no longer needs. It degrades stability over time and can be triggered deliberately to cause a crash or denial of service.

What is a null pointer dereference?

A program attempting to use a memory reference that points to nothing, causing a crash. Can be leveraged for denial of service or, in some cases, code execution.

What is session replay in an application context?

Capturing a valid session cookie or token and reusing it to impersonate the authenticated user without needing their credentials.

What is cookie manipulation?

Modifying cookie values — role flags, user IDs, prices — to escalate privileges or alter application behavior when the server trusts client-side data.

What are the general indicators of an application attack?

Spikes in HTTP 4xx/5xx errors, WAF or IPS alerts, malformed or unusually long input in logs, requests to nonexistent paths, and abnormal traffic from a single source.

What are the core defenses against application attacks?

Input validation and output encoding, parameterized queries, least-privilege service accounts, secure session handling, a WAF, and keeping frameworks and dependencies patched.