ch 5 Flashcards
Three most common attacks are
Man in the middle
Man in the browser
Replay attacks what are these classified as?
Interception attacks
Two computers are sending and receiving data with a computer between them.
(MITM) Man in the middle
Occurs between a browser and the underlying computer.
Usually begins with a Trojan infecting the computer and installing an “extension” into the browser configuration.
(MITB) man in the browser
attacker makes a copy of transmission before sending it to the original recipient.
Preventing replay attacks, both sides can communicate and negotiate a random key. Use timestamps in all messages and reject all message that fall outside of the time.
Replay
The act of introducing a substance that harms or destroys.
Three types of attacks that inject “poisoning”
Poisoning
Address resolution protocol, if the IP address for a device is known but the MAC address is not, the sending computer sends the ARP packet to determine the MAC address.
Relies upon Mac Spoofing
ARP Poisoning
Domain name system is the current basis for name resolution to the IP address.
Two locations for DNS poisoning / Local host table / external DNS server.
DNS poisoning
exploiting a software vulnerability to gain access to resources that the user normally would be restricted from accessing.
Privilege Escalation
when a lower privilege user access functions restricted to higher privilege users.
Vertical privilege escalation-
User restricted privilege access different restricted functions of a similar user.
Horizontal privilege escalation
Compromised server can provide threat actor’s with its privileged contents to provide an opening for attacking any of the devices that access that server.
Server attacks
deliberate attempt to prevent authorized users from accessing a system by overwhelming it with requests.
(DoS) Denial of Service
Using hundreds of thousands of devices flooding the server with requests.
(DDoS) distributed Denial of Service
attack broadcasts a network request to all the computers on the network but changes the address from which the request come from IP Spoofing.
Smurf attack
– floods victims by redirecting valid responses to it.
DNS amplified attack
Takes advantage of procedures for initiating a session.
SYN flood attack
– an attack that exploits previously unknown vulnerabilities, victims have not time to prepare for or defend against the attack.
Zero Day attack
Threat actor takes advantage of web applications that accept user input without validating it before presenting it back to the user.
Cross- site Scripting (XSS) attack
This attack uses the user’s web browser settings to impersonate that user.
(XSRF) Cross-site Request Forgery
introduce new input to exploit a vulnerability.
Injection attacks
used to view and manipulate data stored in relational database.
(SQL) Structured Query Language
Several server attacks are the result of threat actors “commandeering” a technology and then using it for an attack.
Hijacking
Attacker attempts to impersonate user by stealing or guessing session token.
An attacker can attempt to obtain attacks to obtain the session token.
By using XXS or other attacks in order to steal the session token from someone’s computer.
Session Hijacking
Users are directed to a fake look alike site filled with ads for which the attacker receives money for traffic generated to the site.
URL Hijacking (also called Typo Squatting)
Registering Domain names that are one bit different.
Bit squatting-
Occurs when a domain pointer that links a domain name to a specific web server is changed by a threat actor.
Domain Hijacking
Hijacking a mouse click, User tricked into clicking a link that is other that what is appears to be.
Clickjacking
– Designed to “overflow” areas of memory with instructions from the attacker.
Overflow Attacks
Occurs when a process attempts to store data in RAM beyond the boundaries of a fixed-length storage buffer.
Buffer Overflow attacks
Result of an arithmetic operation exceeds the maximum size of the integer type used to store it.
Integer overflow
An attacker changes the value of a variable to something put outside the range that the programmer had intended by using an integer overflow.
Integer overflow Attack
Several attacks to use ads or manipulate the advertising system.
Advertising Attacks
– Threat actors use third- party advertising networks to distribute malware to unsuspecting users who visit a well-known site.
malvertising
Threat actors manipulate pre-roll ads to earn ad revenue that is directed back to them.
Ad Fraud
Web browser additions have introduced vulnerabilities in browsers that access servers.
Browser vulnerabilities
– Expand the normal capabilities of a web browser
Extensions
Adds new Functionality to a web browser so users can play music, new videos, or display special graphical images (java, adobe Flash Player, Apple Quicktime, and Adobe acrobat reader)
Plug-in
Add a Greater degree of functionality to the web browser.
Add-Ons
what is
whatever’ AND email is NULL;–
determine the name of different fields in the database
what is (whatever' AND 1=(select COUNT (*)FROM tabname);--)
discover the name of the table
what is
whatever’ OR full name LIKE Mia)
find specific users
what is
whatever’; DROP TABLE members; –
erase the database table
whatever’; UPDATE members SET email= ‘attacker-email@evil.net’ WHERE email = ‘Mia@good.com
Mail password to attackers email account
