Application Attacks - CompTIA Security+ SY0-701 - 2.4

Understanding Injection Attacks and Their Implications

What is an Injection Attack?

• An injection attack allows attackers to insert malicious code into input sent to a server or client device, exploiting applications that lack proper input validation.

• SQL injection is the most common type of injection attack, but others include HTML, XML, and LDAP injections.

Buffer Overflow Attacks

• A buffer overflow occurs when more data is written to a memory area than it can hold, potentially allowing attackers to manipulate adjacent memory buffers.

• While difficult for attackers to exploit consistently due to variable memory behavior, successful exploitation can lead to significant application vulnerabilities.

Replay Attacks Explained

• Replay attacks involve capturing valid session information (like username/password hashes or session IDs) and reusing it to gain unauthorized access.

• Attackers may use techniques like network taps or malware on victim devices to gather necessary information for replaying against servers.

Privilege Escalation Risks

• Users typically receive permissions based on their roles; however, attackers seek elevated privileges through known vulnerabilities in applications.

• Privilege escalation can be vertical (gaining admin rights) or horizontal (accessing another user's permissions), both posing serious security risks.

Mitigating Privilege Escalation

• To prevent privilege escalation, it's crucial to patch vulnerabilities and update antivirus/anti-malware signatures regularly.

• Techniques such as Data Execution Prevention (DEP) and memory randomization help protect against exploits by limiting executable areas in memory.

Example of a Vulnerability: CVE 2023-29336

• CVE 2023-29336 is a Win32k Elevation of Privilege vulnerability affecting multiple Windows Server versions and Windows 10. Exploiting this could grant system-level privileges.

Cross-Site Request Forgery: Understanding Its Mechanism

How Cross-Site Requests Work

Understanding Web Processes and Security Vulnerabilities

The Basics of Web Page Loading

• When visiting a website, information is loaded from various servers without requiring user authentication, meaning you don't need to provide credentials for services like YouTube or Instagram.

Client-Side vs. Server-Side Code

• Websites utilize two types of code: client-side (HTML/JavaScript) that runs in the browser and server-side code that processes requests on the web server.

• The server handles tasks such as processing HTML/PHP requests and executing transactions like fund transfers, which are not visible to the user's browser.

Understanding Cross-Site Request Forgery (CSRF)

• Attackers exploit the trust established between a user's browser and a website through CSRF attacks, also known as one-click attacks or session writing (abbreviated as XZF or CSRF).

• If a user is logged into a site like Facebook, an attacker can trick their browser into making unauthorized posts by sending malicious links.

Anti-Forgery Techniques

• Many applications implement anti-forgery measures using cryptographic tokens to ensure that requests made by clients are legitimate.

• An example scenario involves an attacker sending a link to a bank's authenticated user, potentially leading to unauthorized fund transfers if clicked.

Directory Traversal Vulnerabilities

• Directory traversal vulnerabilities arise from misconfigurations in web servers allowing attackers access to files outside the intended directory scope.

• Properly configured servers should restrict users to specific directories; however, vulnerabilities may still exist due to software flaws or improper configurations.

Example of Directory Traversal Attack