1.3 Analyze potential indicators associated with application attacks Flashcards
(41 cards)
The ability to run any software on a target system.
Arbitrary code execution
When a user account is able to obtain unauthorized access to higher levels of privileges.
Privilege escalation
A form of malicious code injection attack in which an attacker is able to compromise a web server and inject their own malicious code into the content sent to other visitors.
Cross-site scripting (XSS or CSS)
Implemented by the programmer by validating input, coding defensively, escaping metacharacters, and rejection script-like input.
Cross-site scripting (XSS) prevention
Characters that have been assigned special programmatic meaning.
Metacharacter
The process of marking the metacharacter as merely a normal or common character, thus removing its special programmatic powers.
Escaping metacharacters
Any exploitation that allows an attacker to submit code to a target system to modify its operations and/or poison and corrupt its data set.
Injection attack
Focuses on executing malicious commands on a vulnerable target system.
Command injection attack
Adds malicious code to an existing script or application.
Code injection attack
An XSS event that plants custom HTML statements.
HTML injection attack
Attempts to deposit a malicious file on a target system.
File injection attack
Allows a malicious individual to perform SQL transactions directly against the backend database through a website front end.
SQL (SQLi) injection attack
An advanced software exploitation technique that manipulates a process’s memory to trick it into loading additional code and thus performing operations the original author did not intend.
Dynamic link library (DLL) injection attack
An input injection attack against a LDAP directory service.
Lightweight directory access protocol (LDAP) injection attack
A variant of SQL injection, where the backend target is an XML application.
XML injection attack
The programmatic activity of retrieving the value stored in a memory location by triggering the pulling of the memory based on its address or location as stored in a pointer.
Pointer/ Object dereferencing
An attack that enables an attacker to jump out of the web root directory structure and into any other part of the filesystem hosted by the web server’s host OS.
Directory traversal
A memory exploitation that takes advantage of a software’s lack of input length validation. They can sometimes allow for arbitrary code execution.
Buffer overflow
A memory security feature of many operating systems aimed at blocking a range of memory abuse attacks, including buffer overflows. It blocks the execution of code stored in areas of memory designated as data only areas.
Data execution prevention (DEP)
A memory management mechanism that ensures that the various elements and components of the OS and other core system code are loaded into randomly assigned memory locations at each bootup.
Address space layout randomization (ASLR)
Strcat(), strcpy(), sprintf(), vsprintf(), memcpy(), bcopy(), getwd(), scanf(), and gets. Usually indicate that a buffer overflow is present.
Unbounded C++ functions
The manipulation of the completion order of tasks to exploit a vulnerability.
Race conditions
Often called race condition attacks because the attacker is racing with the legitimate process to replace the object before it is used.
Time-of-check-to-time-of-use (TOCTTOU or TOC/TOU) attacks
When a process, a procedure, or an input causes an error, the system should revert to a more secure state.
Error handling
