Security Plus Flashcards
Attack an account with the top three (or more) passwords. If they don’t work, move to the next account. No lockouts, no alarms, no alerts.
Spraying attack
They identify patterns in data and improve their predictions.
Machine Learning
Gain higher-level access to a system. Horizontal privilege escalation User A can access user B resources.
Privilege escalation
Attacker embeds malicious scripting commands on a trusted website.
Cross-Site Scripting (XSS)
Attempts to get data provided by the attacker to be saved on the web server by the victim. Attacker posts a message to a social network with malicious payload.
Cross-Site Scripting (Stored/Persistent)
Attempts to have a non-persistent effect activated by a victim clicking a link on the site. Attacker emails a link that takes advantage of this vulnerability. Runs a script that sends credentials/session IDs/cookies to the attacker.
Cross-Site Scripting (Reflected)
Attack consisting of the insertion or injection of an SQL query data from the client to a web application.
SQL injection
Insertion of additional information or code through data input from a client to an application. Examples, SQL, HTML, XML, and LDAP.
Injection Attack.
What injection attack is prevented through input validation and using least privilege when accessing a database.
SQL injection.
’ OR 1=1
SQL Injection.
Application verify that information received from a user matchers a specific format or range of value.
Input Validation.
Occurs when a process stores data outside the memory range allocated by the developer
Buffer Overflows.
Network-based attack where a valid data transmission is fraudulently or malicious rebroadcast, repeated, or delayed.
Replay Attack.
A technique that allows an attacker to authenticate to a remote server or service by using the underlying NTLM or LM hash instead of requiring the associated plaintext password.
Pass the Hash.
Attacker intercepts the session ID and uses it to access the server with the victim’s credentials.
Session Hijacking.
