13B: Launch Session Attacks Flashcards
3.3 Given a scenario, research attack vectors and perform application-based attacks. 3.7 Given a scenario, perform post-exploitation techniques.
A malicious actor steals a user’s session credential then uses it to impersonate the user.
session hijacking
Text file used to store information about a user when they visit a website. Some sites use these to support user sessions.
cookie
An attack that forces a user to browse a website in the context of a known and valid session.
session fixation
This requires having access to the user authentication process itself, so that it can be intercepted and repeated.
session replay
A malicious script hosted on the attacker’s site that can exploit a session started on another site in the same browser.
cross site request forgery (CSRF/XSRF)
An attack where an attacker takes advantage of the trust established between the server and the resources it can access, including itself.
server site request forgery (SSRF)
CompTIA definition: When a user accesses or modifies specific resources that they are not entitled to.
AKA: This type of privilege escalation involves gaining access to the rights of another account—human or machine—with similar privileges.
horizontal escalation
When an attacker can perform functions that are normally assigned to users in higher roles, and often explicitly denied to the attacker.
vertical escalation
Vulnerabilities that arise from implementation and design issues that lead to unintended behavior.
business logic flaws
