Lesson 13 - Group 4: Application Attack Indicators

Application attack

An attack targeting vulnerabilities in application code, architecture, or design.

Privilege escalation

Exploiting a vulnerable process or access-control weakness to gain additional privileges.

Vertical privilege escalation

Gaining a higher privilege level than the user currently possesses.

Horizontal privilege escalation

Accessing another user’s resources while remaining at a similar privilege level.

Remote code execution

Running attacker-controlled code on a target system after transferring or delivering the code from another system.

Buffer overflow

Supplying more data than an allocated memory area can hold, potentially allowing arbitrary code execution.

Replay attack

Resubmitting captured authorization tokens or session cookies to obtain an authenticated session.

Cookie hijacking

Stealing or predicting a session cookie and using it to take over an authenticated session.

CSRF or XSRF

Cross-Site Request Forgery; causes an authenticated user’s browser to submit an unintended request to a trusted site.

SSRF

Server-Side Request Forgery; causes a server to make attacker-controlled API calls or HTTP requests.

What weaknesses enable SSRF?

Weak authentication between internal services, weak access control, poor input validation, and request-parsing flaws.

SQL injection

Injecting database query syntax into application input to alter a SQL query.

Persistent XSS

Malicious script content stored by an application and later executed in users’ browsers.

XML injection

Manipulating XML input or document structure.

XXE

XML External Entity attack that uses external entities to access or exfiltrate files and data.

LDAP injection

Injecting LDAP query syntax to manipulate directory searches or updates.

Directory traversal

Using path manipulation to access files outside the intended web root directory.

What techniques may hide directory-traversal input?

Canonicalization tricks and percent encoding.

Command injection

Causing a server to execute operating-system shell commands.

What HTTP methods are listed for URL analysis?

GET, POST, and PUT.

What should analysts examine during URL analysis?

The domain, path, query parameters, HTTP method, and percent-encoded content.

What web-server log sources are listed?

Error logs, traffic logs, HTTP status codes, and HTTP header