Search for a command to run...
My name is Valentina. but hey, just call me Vally, which means strength. I am the Powerhouse behind Cyvally. Vally is a rising cybersecurity professional and a content creator, I write to make cybersecurity and cloud topics understandable and interesting to you (after all, who likes boring?).
No comments yet. Be the first to comment.
Welcome to Cyber Shell! Explore cybersecurity resources, including courses and certifications, tailored to all experience levels. Stay updated with the latest trends, and explore opportunities to advance your skills and career. Thanks for visiting!
Ella was a diligent student who devoted most of her time to her studies. One day, she got an email with an appealing subject line: "Exclusive Study Tips!" She clicked on the email without hesitation since she was eager to learn new techniques to thri...
I recently discovered that generations before Gen Y had their own official names, too. For the longest time, I assumed the naming trend began with Gen Y, the Millennials, then continued with Gen Z, and now Gen Alpha. But like everything else in histo...
Seen the film Extraction? Cyvally chooses a cyber action thriller, so you may be thinking Why Cyvally is linking an action thriller film genre to cyber security. Anyway, that’s one of the perks of being a cybersecurity enthusiast: everything gets you...
I believe it is safe to claim that our moms were among the early adopters of encryption, with their "coded" ways of interacting with their children, ensuring their messages, particularly warnings, can only be understood by you. This can be achieved b...
My first time boarding the yellow buses in Lagos State wasn't a funny one. I took a bus from Lekki Phase 1 to Ajah. As a Yoruba girl who had stayed in Port Harcourt and was just arriving in Lagos, my first instinct wasn't to use the popular "owa" to ...
During my previous role as a Network Performance Optimization (NPO) engineer, in my first month on the job, I received a serious warning from my line manager during one of our training sessions. He emphasized the importance of getting official approv...
Dear Cyvally Readers,
I am sure you are expecting a storyline to begin introducing the different types of application attacks. However, I decided to spice things up today by providing us with a short scenario to explain each application attack. I have heard a lot of people complaining that this objective of the CompTIA sec+ is boring and they find it challenging, so I'm hoping this method will help to make the concepts clearer, relatable, and easily understandable. also, I will appreciate your feedback, as it will assist me in updating the content depending on your comment and suggestions. On this note, make sure to return to each post to ensure you are up to date with the latest info. I appreciate your continued support.
CYVALLY READERS ARE THE BEST!!!
Stay in the loop!!!
As a Cybersecurity Professional, you will frequently encounter the term threat actors, who use code execution attacks to break into networks on hosts, resulting in major issues such as data asset breaches, denial of service attacks, and exploitation of privileges and access. YOU DON'T WANT THESE ISSUES, DO YOU?
HEARD ABOUT ARBITRARY CODE EXECUTION AND REMOTE CODE EXECUTION?
you can deduce each word from its name; the word arbitrary means "random." ACE indicates a threat actor exploiting a vulnerability and executing random code on the target system. RCE indicates an attacker executing code on a remote target.
In this post, you will learn about application attack indicators to help identify present or future attacks on applications. By thoroughly investigating these indicators, you and I will be able to detect and respond to application attacks SOMEDAY. I HOPE YOU'RE EXCITED, AS I AM.
#1: Privilege escalation
The term "escalation" refers to the process of making something bigger or more serious. Privilege escalation occurs when an attacker upgrades their access level from user to administrator/root, they get greater control over a system, network, or application.
SCENARIO: Assume Harry, an attacker carried out a phishing attack (I ASSUME YOU UNDERSTAND WHAT A PHISHING ATTACK IS) that allowed him to obtain unauthorized access to ABC's company network. Beginning as a regular user, he discovers and exploits a weakness in the system that allows him to increase his privileges as he gains access to the admin account( OUCH!!!, YOU PROBABLY KNOW THE END TO THIS STORY
There are two types of privilege escalation attacks, vertical and horizontal. Vertical occurs when an attacker attempts to elevate their privileges to a higher level than their initial access while horizontal occurs when an attacker aims to attain the same level of privileges as initial account.
Mitigation
#2: Cross-site scripting
Cross-Site Scripting (XSS) is a web security vulnerability where attackers inject malicious scripts into web pages. This occurs due to weak user input validation. When a victim visits the compromised page, the injected script executes in their browser, allowing attackers to steal data or perform unauthorized actions.
Scenario: In an online forum, an attacker named Linda identifies a vulnerability in the comment section. Exploiting this vulnerability, Linda injects malicious code, such as <script>alert('XSS')</script>, into the search field. When the user clicks on the "enter" button, the injected script executes, potentially causing harm or displaying unwanted content.
TIP: Notice <script> was used to indicate it is a XSS code
There are 3 types of XSS attacks;
Reflected/non-persistent XSS: occurs when the malicious script is provided over the web server without being stored or persistent.(it is due to server-side flaw)
Persistent XSS: when website's database stores the script permanently.(due to server-side flaw)
DOM-based XSS: occurs due to flaw in the client-side code.
Mitigation
#3: Injections Types
Structured query language (SQL): is a vulnerability that allows an attacker to tamper with database queries made by an application. It allows an attacker to the read and modify sensitive data from the database(Insert/Update/Delete). Proper input validation, parameterized queries, and regular software updates are required to prevent SQL Injection.
' or 1=1--
The string ' or 1=1-- is a common SQL Injection payload. It can be used to bypass authentication by manipulating the SQL query executed by the application. The 1=1 condition is always true, allowing unauthorized access to the system or retrieval of sensitive information from the database.
DLL Injection: A Dynamic-Link Library is a Windows library that allows sharing of code with other programs to perform specific tasks. DLL injection is a vulnerability where arbitrary code is executed into another process's address space by forcing it to load a foreign DLL. keep antivirus software up-to-date to prevent DLL Injection.
Lightweight Directory Access Protocol Injection: is an application attack that targets web-based applications by manipulating LDAP statements, usually generated from user input. LDAP is used for reading and writing network directory databases. An attacker can exploit either unauthenticated access or vulnerabilities in a client application to inject arbitrary LDAP queries. This can lead to unauthorized activities such as creating or deleting accounts, as well as modifying authorizations and privileges. Proper input validation and encoding prevents LDAP Injection.
Extensible Markup Language Injection: XML is a markup language that allows you to define any data with rules. XML Injection is a type of attack that manipulates or compromises the logic of an XML application or service. Proper input validation prevents XML Injection.
#4: Pointer/object dereference
Pointer dereference is a vulnerability that occurs when code attempts to access memory through a pointer, but the pointer itself is null or points to an invalid memory location. Pointers in languages like C/C++ store memory addresses, and dereferencing a pointer involves reading from or writing to the memory location it points to.
Scenario: An attacker named Nick took advantage of a weakness in a banking application to exploit a null pointer assignment. Nick causes a null pointer dereference error during account retrieval by giving a null value as the account pointer, resulting in a bank service crash and Nick gaining unauthorized access to sensitive data.
Mitigation
#5: Directory Traversal Attack
A directory traversal attack occurs when an attacker gains access to files or folders outside the intended scope of an application. This attack exploits the improper handling of user input used to construct file paths or directory references. By manipulating the input, the attacker can deceive the application into accessing unauthorized files or folders.
Scenario: For instance, a certain application allows users to download files by providing the file name in the URL, an attacker inserts "../" sequences to access files beyond the app's designated download folder and browse through the directory tree(INSERT HEARTBREAK EMOJI) this led to disclosure of confidential data, unauthorized access, or even remote code execution.
Mitigation
#6: Buffer overflows
A buffer overflow occurs when data surpasses the capacity of a target buffer, causing damage to adjacent memory. This can lead to system crashes or enable attackers to execute unauthorized code. During a buffer overflow attack, the attacker intentionally sends data that exceeds the intended capacity of the buffer.
Scenario: For example, a program that expects a maximum of 15 characters for a username but receives a string of 100 characters can experience a buffer overflow if not handled correctly.
Mitigation
Note: Bounds checking is a programming security approach that validates and enforces the right boundaries of arrays or buffers.
#7: Race conditions
A race condition is a vulnerability that occurs when the outcome of a program depends on the sequence and timing of events. It refers to the situation where multiple operations are performed at same time. Race conditions can be found in distributed or multithreaded programs.
Scenario: Jossy and Presh are both attempting to book the last remaining seat for an Infosec.Live event. Before booking the seat, each checks the value of "availableSeats" to ensure there is still a seat available. However, due to a race condition, both Jossy and Presh read the value of "availableSeats" simultaneously and mistakenly determine that there is still one seat available. Consequently, both proceed to book the seat at the same time.
Time of check/time of use: is a vulnerability that arises when there is a time gap between when a resource is checked and when it is actually used, allowing for potential modifications or compromises to occur during that interval.
Mitigation
#8: Improper Error handling
Errors are inevitable in every application and so should be handling properly. Attackers can exploit error management procedures to gain access to sensitive data by intentionally triggering errors.
Scenario: An attacker exploits a weakness in the authentication process by submitting a specifically designed username that causes an error. This forces the application to display a generic error message, revealing the existence of the username in the system. Although the password is incorrect, this information allows the attacker to launch further attacks, such as password brute-forcing.
Mitigation
#9: Improper input handling
Attackers often exploit insufficient input validation by sending malicious data to vulnerable processes. This can result in various security vulnerabilities such as SQL injections, buffer overflows, and denial of service attacks.
Scenario: An attacker named Alex uses SQL injection to modify the database of an online shopping application with a flawed search feature. By inputting a devised search query, the application executes it without adequate validation, allowing the injected SQL code to run. Alex can then use the poor input processing vulnerability to access sensitive data, change prices, or remove the entire product catalog.
Mitigation
#10: Replay attack
Replay attack involves intercepting and reusing authentication data to establish a session. The goal of replay attacks is to recreate the conditions of a previous event. If an attacker can record a series of packets, they can easily replay them, potentially making previously legitimate actions valid again.
Scenario: an attacker captures and records a user's payment transaction, and then replays it multiple times. This deceives the system into processing duplicate payments, allowing the attacker to gain unauthorized benefits.
Session replays: When a user establishes a web connection to a system, the connection creates a "session" in the sense that the different data sent back and forth create an interaction between the client and the server. The recreation of this interaction after it has already taken place is known as a session replay.
Scenerio: a legitimate user, Baron, securely logs into an online banking application and performs transactions. Meanwhile, a malicious attacker named Adam captures the session data, including the session identifier and authentication token. Even after Baron logs out, Adam replays the captured session data to the banking application's server. The server, unaware of the replayed session, validates the data and grants unauthorized access to Baron's account.
Mitigation
#11: Integer overflow
Integers (whole numbers) are data types defined with fixed lower and upper bounds. An integer overflow attack occurs when a computed result is too large to fit in the allocated storage space, resulting in a crash or data corruption, as well as a buffer overflow.
Scenario: For Instance, positive number becoming negative such as transferring money from one account (the debit account) to another account (the credit account)(NO WONDER WE HATE DEBIT ALERT)
Mitigation
#12: Request Forgeries Types
Server-side request forgery (SSRF): SSRF occurs when an attacker manipulates a server-side application to send HTTP requests to a domain chosen by the attacker. This attack exploits the trust relationship between the server and the target, leading the vulnerable application to perform unauthorized actions. SSRF commonly targets the server itself or other back-end systems within the organizations
Cross-site request forgery (XSRF): CSRF occurs when an attacker manipulates a user's browser to execute undesirable actions on another website without the user's knowledge or consent. This is accomplished by taking advantage of the trust that websites have in the user's browser.
Scenario: In a CSRF attack, an attacker can exploit a bank's lack of authentication checks for each transaction. If a user is logged in and their browser remains open, the attacker can send a hidden request from another tab, making it appear as if the user initiated the transaction when, in reality, they did not. This allows the attacker to perform unauthorized financial activities on the user's behalf.
Mitigation
#13: Application programming interface (API) attacks
APIs are used to provide/feed data to an application. They are commonly used in web apps and cloud services to enable consumers to automate tasks. If an API is not secure, threat actors can easily exploit it to compromise the web application's services and data. Therefore, it is critical to ensure that the API is accessed exclusively through an encrypted channel (HTTPS).
Scenario: An online shopping platform has an insecure API endpoint for fetching product details. An attacker named Mike exploits this vulnerability by sending unauthorized requests to the API. Using a script, Mike retrieves sensitive information, including product prices, customer reviews, and inventory status.
Mitigation
#14: Resource exhaustion
Resource exhaustion happens when a system lacks sufficient resources like capacity and memory, leading to system crashes and service disruption. Attackers exploit this vulnerability to deplete resources, causing system overload.
Scenerio: by overwhelming a system with TCP SYN requests or exhausting program memory which affect customer-facing systems and essential services. They target CPU time, memory, disk capacity, and network utilization, rendering systems unresponsive or filling up state tables.
Mitigation
#15: Memory leak
Memory management is the process of controlling and coordinating computer memory, allocating it to variables, and reclaiming it when it is no longer required. Memory leaks occur when allocated memory is not released once it is no longer in use. This can result in increased resource usage over time, potentially causing system instability.
Scenario: A web-based app allows users to upload photographs, but a code issue prevents the allotted memory from being released once the images have been processed and stored. Memory accumulates without being released as users submit more photographs, resulting in a memory leak. As memory utilization increases, the application's resources are depleted, resulting in system instability or crashes.
Mitigation
#16 : Secure Sockets Layer (SSL) stripping(HTTP downgrade)
SSL stripping is a man-in-the-middle attack against all SSL and early versions of TLS connections where an attacker downgrades a secure HTTPS connection to an insecure HTTP connection. By intercepting the traffic, the attacker can manipulate and read or modify the transmitted data. The reason the attack works is because the beginning of an SSL or TLS (v1.0 or v1.1) handshake is vulnerable to attack.
Mitigation
#17: Driver manipulation
Drivers act as a bridge between the operating system and peripheral devices. Drivers may have less protection compared to other core system components but are still integral to its functioning.
Shimming: A shim is an additional code that is placed between an application driver and the operating system to enable functionality that would otherwise be unavailable. It allows modifications between different OS versions without altering the original driver code, giving it flexibility and portability. Shimming can be exploited by malicious code to change the functionality of a driver without altering the driver itself.
Refactoring: the practice of restructuring application code in order to improve its design and performance while retaining its original functionality. It can be used to improve code or to deal with certain scenarios. However, attackers can use refactoring to introduce illegal functionality to a driver while still allowing it to work normally. it is a Metamorphic malware that can appear different each time
#18: Pass The Hash
This is an attack in which the attacker takes hashed user credentials and uses them to authenticate on the same network or other systems without knowing the original password. This technique makes use of hashed passwords rather than plaintext passwords for authentication.
Mitigation
Time is what determines security. With enough time nothing is unhackable.
Aniekee Tochukwu Ezekiel
Review Questions
