1.3 Given a scenario, analyze potential indicators assoicated with application attacks

Question 1

Privilege escalation

Answer 1

An attacker exploits a bug within an application to bypass the application and gain elevated privileges that enable the attacker to execute system commands.

Protection against privilege escalation requires that programmers use input validation and test their code for bugs and exploits before releasing the software.

Question 2

Cross-site scripting (XSS)

Answer 2

Cross-site scripting (XSS) is a type of website application vulnerability that allows malicious users to inject malicious code into dynamic websites that rely on user input.

Question 3

Injections

Answer 3

Injections insert code into a running process, forcing a program to behave in a manner that it was not intended to do.

1. Structured query language (SQL)
2. Dynamic Link Library
3. Lightweight Directory Access Protocol
4. XML injections

Question 4

Structured query language (SQL) Injection

Answer 4

The attacker sends SQL input to the database via an input form. The results returned to the attacker are responses to those commands, giving the attacker access to information stored within the database that shouldn’t be available to the attacker.

Question 5

Dynamic Link Library (DLL) injection

Answer 5

DLL injections exploit DLLs by inserting code into a DLL and then having the original process load and execute the code within the DLL.

Question 6

Lightweight Directory Access Protocol (LDAP) injection

Answer 6

Which is like a SQL injection attack, inserts code into user-based input that is utilized in a query to an LDAP server.

Question 7

Extensible Markup Language (XML) injections

Answer 7

Can modify how an XML application processes data. By injections into the XML application, the attacker causes the application to process data according to the malicious injected XML code.

Question 8

Pointer/object dereference

Answer 8

An attack that consists of finding null references in a target program and dereferencing them, causing an exception to be generated.

Dereferencing means taking away the reference and giving you what it was actually referring to.

The vulnerability in memory that usually causes the applications to crash or a denial of service is a Null Pointer dereference.

In this case, there is nothing at that memory address to dereference and the application crashes.

Question 9

Directory Traversal

Answer 9

A type of access vulnerability that enables a hacker to get unauthorized access to files on a web server other than the public files that are served on the website.

Question 10

Buffer overflow

Answer 10

Buffer overflow is a programming term used to describe when input data exceeds the limits recognized by a program.

In a buffer overflow attack, the extra characters are malicious code that causes the program or even the entire system to crash.

Question 11

Race conditions
—Time of check/time of use

Answer 11

Race condition happens when an application is dependent on the steps to be performed in an appropriate order, and the steps are subsequently then executed out of order, creating a crash or other negative situation that can be exploited by an attacker.

Time of check/time of use, this condition occurs when Step A occurs and then the state changes before the use of that authentication occurs.

Time of check/time of use (TOC/TOU) issue is a race condition that occurs when a program checks access permissions too far in advance of a resource request.

Question 12

Error handling

Answer 12

Error handling could ensure that out-of-range numerical values are handled in safer ways, such as by converting the value to text, truncating or converting it, or ignoring unexpected values.

Question 13

Improper input handling

Answer 13

Improper input handling that allows so much data to be entered into the application that the processing limits are exceeding.

Question 14

Replay attacks

Answer 14

An attempt to reuse authentication requests.

Occurs when an unauthorized user captures network traffic and then sends the communication to its original destination, acting as the original sender.

To prevent replay attacks, you can implement time stamps, sequence numbers, or randomized session IDs.

Question 15

Replay attacks
— Session replays

Answer 15

Session replay, an attacker steals a valid session ID of a user and reuses it to impersonate an authorized user and perform fraudulent transactions or activities.

Preventing session replay, disallow session ID use in web apps

Question 16

Integer overflow

Answer 16

Putting too much information into too small of space that has been set aside for numbers.

The outcome of a successful integer overflow attack is like that of a buffer overflow attack.

This attack can be prevented through input validation and also error handling condition in the web app programming that deal with such overflow conditions.

Question 17

Request forgeries

Answer 17

Request forgeries attacks exploit trust relationships and attempt to have users unwittingly execute commands against a remote server.

They come in two forms: cross-site request forgery and server-side request forgery.

Question 18

Cross-site request forgery (XSRF)

Answer 18

XSRF attacks exploit the trust that remote sites have in a user’s system to execute commands on the user’s behalf.

XSRF attacks work by making the reasonable assumption that users are often logged into many different websites at the same time. Attackers then embed code in one website that sends a command to a second website. When the user clicks the link on the first site, they are unknowingly sending a command to the second site. If the user happens to be logged into that second site, the command may succeed.

Question 19

Server-side request forgery (SSRF)

Answer 19

Server-side request forgery attacks exploit a similar vulnerability but instead of tricking a user’s browser into visiting a URL, they trick a server into visiting a URL based on user-supplied input

Question 20

Application programming interface (API) attacks

Answer 20

API serves as a translator between systems and software, defining what and how elements can be called.

API attacks seek to use the API to achieve an impact such as DoS, data exfiltration, or code injection.

Question 21

Resource exhaustion

Answer 21

Resource exhaustion attacks take advantage of the limited resources that most modern computer systems have available for software applications.

Resource exhaustion essentially creates DoS condition, because the resources that are needed to execute actions associated with an application are entirely exhausted, leading to either an error, performance slowdown, or a DoS.

Question 22

Memory leak

Answer 22

Memory leaks are one example of resource exhaustion.

If an application requests memory from the operating system, it will then return the memory to the operating system for other uses.

In the case of an application with a memory leak, the application fails to return some memory that it no longer needs, perhaps by simply losing track of an object that it has written to a reserved area of memory.

If the application continues to do this over a long period of time, it can slowly consume all the memory available to the system, causing it to crash.

Rebooting the system often resets the problem, returning the memory to other uses but if the memory leak isn’t corrected, the cycle simply begins anew.

Question 23

Secure Socket Layer (SSL) stripping

Answer 23

SSL stripping attacks that downgrade your security from encrypted HTTPS to plain HTTP in order to gain access to the information that otherwise would have been sent securely.

Question 24

Driver manipulation
— Shimming
— Refactoring

Answer 24

Shimming, takes a legitimate driver and wraps a malicious driver around the outside of it.

Refactoring, if attackers have access to the driver’s source code, they can modify it to also include malware elements. Not easy to pull off.

Question 25

Pass the hash

Answer 25

Pass the hash is another form of replay attack that takes place against the operating system rather than a web application.

The attacker begins by gaining access to a Windows system and then harvests stored NTLM password hashed from that system. They can attempt to use these hashed to gain user or administrator access to that system or other systems in the same Active Directory domain.

NT Lan Manager