Types of Attacks - Technical Flashcards
Attacker exploits know vulnerabilities in specific app or OS or attack features in specific protocols or services in an attempt to deny authorized users access to an info system or features of that Info system.
Denial of Service (DoS)
A DoS carried out using multiple attack system.
Distributed Denial of Service (DDoS)
DDoS type of attacks can be made up of compromised systems that are unwitting participants in an attack
Zombie Attack
Comprised of capturing traffic between two hosts. The attacker can observe traffic before relaying it. To the sending system it appears that all communication is occurring normally since all expected replies are received.
Man-in-the-Middle (MITM)
Input buffer used to hold input is overwritten with data that is larger than the buffer can handle and happens due to error-checking not present in the way the application is written, whether it be due to poor coding practices or limitations of the programming language used.
Buffer Overflow
Input from users is not validated against expected results and allows attackers to obtain command-line access at the privileged level of the application.
Injections
Takes advantage of user input not being validated properly and is one of the most common web attacks. If the input is not validated properly, an attacker can include their script in their input and have it rendered as part of the web process.
Cross-Site Scripting (XSS)
XSS TYPE
Injected script is not stored but immediately executed and passed back via the web server.
Non-persistent XSS attacks.
XSS TYPE
Script is permanently stored on the web server or on some back-end storage system and allows the attacker to continue log the script against those who log into the system.
Persistent XSS attacks.
XSS TYPE
Script is executed in the browser via the DOM process as opposed to on the web server
DOM-based XSS attack
XSS ATTACK
Theft of authentication
Web apps
XSS Attack
Session
Hijacking
XSS Attack
Deploy hostile
Content
XSS Attack
Change user
Settings
XSS Attack
Impersonate
Users
XSS Attack
Phishing or stealing
Sensitive Information
Attacker utilizes authorized activity to be performed outside authorized use against sites that have authenticated users - exploits the trust in previous authentication request.
Cross-Site Request Forgery (XSRF)
First step is to obtain root or admin level access and is called.
Privilege Escalation
Create a DoS and sufficient enough volume of packets to overwhelm a host such as a large server - more than one device is needed.
Amplification.
Attackers make unauthorized incorrect modifications to a DNS table of the host system.
DNS Poisoning
Act of changing the registration of a domain name without the permission of its registrants and spreads false domain locations via the DNS system
Domain Hijacking
Variant of MITM - installed piece of malware on a compromised system that “watches” user activity in their browser and when the user navigates to a certain site (such as a bank) the malware creates diff set of instructions - ie redirecting bill pay to transfer to attackers account
Man-in-the-Browser
Attack that takes advantage of a vulnerability that a software vendor is not aware of.
Zero Day
Attacker captures communication and replays it later to circumvent authentication mechanisms such as capturing and reusing certificates or tokens.
Replay attack
Chances are if you authenticate with a username and password, your system doesn’t capture your password, rather it hashes it out, and that is what’s passed to your authentication mechanism. If an
attacker were to capture that hash and reinsert it into an authentication attempt, the system would verify
correctly, giving them access. This is known as a ”pass the hash” attack
Pass the hash
The attacker tricks a user into clicking something different than what is displayed on the userinterface, using an overlay with invisible clicking elements that align with actual elements.
Clickjacking
Refers to the process of taking control of an already existing session. The attacker doesn’t
have to circumvent any authentication mechanisms as the user has already authenticated
Session Hijacking
Oftentimes, attacks need some type of user interaction. If an attacker can
get you to navigate to their site which houses their malicious payload, they’re winning the battle. One way to
accomplish this is with URL Hijacking, forcing users to navigate to a site they didn’t intend to. For
typosquatting, what happens is attackers set up their nefarious page with similar names to legitimate
businesses. For instance, they’ll replace letters that are commonly mistaken, such as an i for an l. Generally,
they’ll create their site to look similar to that of the one you intended to navigate to. This is done so that they
can capture your authentication information.
URL Hijacking and Typosquatting
An attack on a system by changing their drivers, thus changing the behaviors of the
system. Drivers are generally less secure than the operating system that they’re connected to, leaving a
security gap that can be exploited.
Driver Manipulation
This is the act of putting code between the OS and the drivers. It has legitimate purposes, but
attackers have found a way to exploit this
Shimming
: Refactoring is the process of restructuring existing code without changing the external behavior
of the code. This is oftentimes done to resolve readability issues or to improve nonfunctional attributes.
Attackers have found ways to use this to add functionality
Refactoring
making data look like its coming from somewhere else
Spoofing
MAC Spoofing
kdjfksjfs
IP Spoofing
lksjdflksf
It’s important to understand how a Smurf attack works as well. Spoofing is used, but in a Smurf
attack, the attacker spoofs a packet to all systems on a particular network and forges the From address so
that the target host gets all the echo replies.
Smurf attack
