1.3 Given a scenario, analyze potential indicators associated with application attacks

Question 1

Privilege escalation

Answer 1

occurs when a user is able to obtain unauthorized access to higher level of privileges

Question 2

Cross-site scripting attack

Answer 2

a form of malicious script-injection attack in which an attacker is able to compromise a web server and inject their own malicious code into the content sent to other visitors.

Question 3

Arbitrary Code Execution

Answer 3

The ability to run any software on a target system

Question 4

Cross-site scripting prevention

Answer 4

The most effective ways to prevent XSS on a resource host are implemented by the programmer by validating input, coding defensively, escaping metacharacters, and rejecting all script-like input.

Question 5

Metacharacters

Answer 5

characters that have been assigned special programmatic meaning.

Question 6

Injection attacks

Answer 6

any exploitation that allows an attacker to submit code to a target system to modify its operations and/or poison and corrupt its data set.

Question 7

Command Injection

Answer 7

focuses on executing malicious commands on a vulnerable target system

Question 8

Code Injection

Answer 8

adds malicious code to an existing script or application

Question 9

HTML injection

Answer 9

effectively an XSS event, but instead of using JavaScript or other code, it plants custom HTML statements.

Question 10

File Injection

Answer 10

Attempts to deposit a file on a target system

Question 11

SQL Injection

Answer 11

allow a malicious individual to perform SQL transactions directly against the backend database through a website front end

Question 12

Dynamic Link Library (DLL) Injection

Answer 12

advanced software exploitation technique that manipulates a process’s memory to trick into loading additional code and thus performing operations the original author did not intend.

Question 13

Lightweight Directory Access Protocol (LDAP) Injection

Answer 13

input injection attack against a LDAP directory service

Question 14

XML Injection

Answer 14

Another variant of SQL injection, where the backend target is an XML application

Question 15

pointer dereference

Answer 15

programmatic activity of retrieving the value stored in a memory location by triggering the pulling of the memory based on its address or location as stored in a pointer.