Threats, Vulnerabilities, Mitigation 5

Question 1

Just name Application attacks

Answer 1

• Injection Attacks
• Buffer Overflow
• Replay Attacks
• Privilege Escalation
• Forgery
• Directory Traversal

Question 2

What is CSRF/XSRF?

Answer 2

• Cross-site request forgery
• Attacker takes advantage of trust that web application has for user

Example:

• Victim still logged in his browser to online banking
• Attacker sends Hyperlink woth forged bank transfer request
• Victim clicks, logged in web browser who thinks transaction is legit and trusts

Question 3

What is SSRF?

Answer 3

• Server-side Request forgery
• Tricks server into visiting URL based on user supplied input

Question 4

What is Directory Traversal?

Answer 4

• Access directories that are outside of website files directory

Reasons:
* Misconfigurations
* Web Server vulnerabilities
* Web application code vulnerability

Indication

../../../

Question 5

What are Cryptographic Attacks?

Answer 5

Birthday Attack
* Leverages possibility of hash taking two different inputs that produce same Hash output
* As more hashing of inputs are generated the higher chance of collission

Mitigation: Larger Hashes

What is a downgrade attack?

• Attack used against secure systems to trick them into shifting communication to less secure cryptographic modes
• Attacker on-path

Example:
HTTPS - HTTP
TLS

Question 6

What are Passwork Attacks?

Answer 6

Spraying
* Trying to guess most common passwords

Brute Force
* Trying all possible combinations

Question 7

Name IOC´s (9)

Answer 7

• Account Lockout
• Concurrent Session usage
• Blocked content
• Impossible travel
• Resource consumption
• Resource Inaccessibility
• Out-of-Cycle logging
• Missing Logs
• Published / Documented

Question 8

What is blocked content?

Answer 8

• IOC
• Attacker wants to stay as long as possible

Therefore, blocked services:

• Auto-update connections
• Links to security patches
• Third Party anti-malware sites
• Removal tools

Question 9

What is Resource consumption?

Answer 9

• Outgoing traffic
• File transfer
• Often Spikes at unusual times

Question 10

What is Out-of-Cycle logging?

Answer 10

• Logging activities or events that occur outside the normal, expected cycle of logging in a system or network
• Firewall log activity
• Operating system patch logs