1.3 Given a scenario, analyze potential indicators associated with application attacks Flashcards
Privilege Escalation
Gain higher-level access to a system
Privilege Escalation
When a user grants themselves HIGHER security privileges than they are supposed to have
Cross-site Scripting (XSS)
A type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.
Cross-site request forgery (XSRF or CSRF)
exploits trust that a user has in a website to execute code on
the user’s computer.
Dynamic-link library (DLL)
Attacker injects a code and the application runs it for the attacker
Lightweight Directory Access Protocol (LDAP)
This can occur when the user’s input is not properly filtered, and the result can be executed commands, modified content, or results returned to unauthorized queries.
Extensible Markup Language (XML)
when users enter values that query XML (known as XPath) with values that take advantage of exploits, it is known as an XML injection attack.
SQL injection attacks
“1+1” input on a web app
Use unexpected input to a web application to gain
unauthorized access to an underlying database.
Point/Object Deference
An attack that consists of finding null references in a target program
and dereferencing them, causing an exception to be generated.
Directory Traversal
If an attacker is able to gain access to restricted directories through
HTTP
Buffer Overflow
appropriate size (allows Input that is too large can “overflow” memory buffer).
Race Conditions
A condition where the system’s behavior is dependent on the
sequence or timing of other uncontrollable events
Error Handling
the user will simply see an error message box
Replay Attack
an attempt to reuse authentication
requests.
Session Replay
an attacker steals a valid session ID of a
user and reuses it to impersonate an
