Application Attacks

Question 1

Privilege Escalation:

Answer 1

• Unusual account activity, such as multiple failed login attempts or suspicious account access.
• Unauthorized access to higher-level system resources.
• Changes in user permissions or roles without proper authorization.

Question 2

Cross-site Scripting (XSS):

Answer 2

• Unexpected or malicious script execution in web application inputs.
• Reports of unusual pop-ups, redirects, or unexpected behavior in web browsers.
• Suspicious input data that appears in web applications logs.

Question 3

Injections (SQL, DLL, LDAP, XML):

Answer 3

• Unusual or authorized database queries, file operations, or LDAP searches.
• Error messages or unusual behaviors indication potential injection attempts.
• Logs or input data containing SQL syntax, DLL file paths, LDAP queries, or XML payloads.

Question 4

Pinter/Object Dereference:

Answer 4

• Application crashes or instability.
• Unexpected memory- related errors or applications exceptions.
• Memory addresses or pointers appearing where they shouldn’t be in logs or memory.

Question 5

Directory Transversal:

Answer 5

• Unauthorized access attempts to restricted directories or files.
• Suspicious transversal characters in URLs or input data (e.g., “..”).
• Access logs showing unusual files or directory access patterns.

Question 6

Buffer Overflows:

Answer 6

• Application crashes or unresponsive behavior.
• Memory corruption-related errors in logs or debug information.
• Sudden increases in CPU or memory usage.

Question 7

Race Conditions (Time of Check/Time of Use):

Answer 7

• Inconsistent application behavior or data integrity issues.
• Logs indicating concurrency-related errors or conflicts.
• Multiple users accessing the same resources simultaneously.

Question 8

Errors Handling:

Answer 8

• Unhandled exceptions or errors messages that reveal sensitive information.
• Logs with repetitive error entries or signs of application instability.
• Reports of unexpected application behavior or crashes.

Question 9

Improper Input Handling:

Answer 9

• Unexpected or malicious input data causing application errors or crashes.
• Logs showing input data with special characters or unexpected formats.
• Input validation or sanitization failures.

Question 10

Replay Attack (Session Replays):

Answer 10

• Repeated login attempts with the same session identifiers.
• Unusual session or authentication activity.
• Logs showing multiple sessions from the same user or IP address.

Question 11

Integer Overflow:

Answer 11

• Unexpected application crashes or errors related to arithmetic operations.
• Logs containing calculations or operations resulting in large or negative values.

Question 12

Request Forgeries (Server-side, Cross-site):

Answer 12

• Unexpected actions or transactions performed without user consent.
• Logs showing unauthorized or unusual requests.
• Detection of forged tokens or session identifiers.

Question 13

Application Programming Interface (API) Attacks:

Answer 13

• Unusual or unauthorized API calls or endpoints.
• Logs indicating high-frequency or suspicious API interactions.
• Reports of API response anomalies or unauthorized data access.

Question 14

Resource Exhaustion:

Answer 14

• Application or system performance degradation.
• Logs with indicators of excessive resource consumption.
• Unusual levels of CPS, memory, or network usage.

Question 15

Memory Leak:

Answer 15

• Gradual increase in memory over time.
• Application instability or crashes due to memory exhaustion.
• Reports of slow performance or unresponsive applications.

Question 16

Secure Sockets Layer (SSL) Stripping:

Answer 16

• Unencrypted data transmission in network traffic.
• Browser warnings or notifications about insecure connections.
• Unexpected plaintext data in intercepted network traffic.

Question 17

Driver Manipulation (Shimming, Refactoring):

Answer 17

• System instability or crashes related to driver issues.
• Unusual driver activity, such as the loading or unloading of drivers.
• Logs with signs of driver tampering or manipulation.

Question 18

Pass the Hash:

Answer 18

• Unauthorized access using hashed credentials.
• Multiple login failures or suspicious authentication attempts.
• Detection of repeated use of the same hash for authentication.