Application Attacks

Privilege Escelation

Gain higher-level access to a system (exploit)

Horizontal Privilege Escalation

• Attacker goes from user to user access

Mitigating Privilege Escalation

• Patches

• Update anti/virus

• Data Execution Prevention

• Address space layout randomization

Cross-Site Request

Loading data into a website

• Data comes from web server

Cross Site Request Forgery

XRSF, CRSF

• One-click attack, session riding

• Take advantage of the trust that a web app has for the user

Ex:

• Attacker sends malicious link

• User clicks (Logged in to bank on click)

• User bank sends money to attacker

Resolution: Cryptographic Token

Directory Traversal

Allows attackers to read/write to a web server

• May lead into finding other directories