Security+ SY0-601 Chap 3dot2 Analyzing Potential Indicators Associated with Application Attacks

White-box testing

Programming and details of the design. Login details, production documentation, and source code.

System testers might use a combination of fuzzing (covered shortly), data flow testing, and other techniques such as stress testing, penetration testing, and sandboxes.

Program errors that occur while the program is being compiled.

is a program error that occurs while the program is running.

Runtime errors might include running out of memory, invalid memory address access, invalid parameter value, or buffer overflows/dereferencing a null pointer (to name a few), all of which can be discovered only by running the program as a user. Another potential runtime error can occur if there is an attempt to divide by zer

A mechanism used to handle software and hardware exceptions.

A process that ensures the correct usage of data; it checks the data that is input by users into web forms and other similar web elements. If data is not validated correctly, it can lead to various security vulnerabilities, including sensitive data exposure and the possibility of data corruption.

You can validate data in many ways, from coded data checks and consistency checks to spelling and grammar checks, and so on.

SQL injection and XSS

On both the client and server side.

A network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed.

a packet sniffer

The first is to use session tokens that are transmitted to people the first time they attempt to connect and identify them subsequently. They are handed out randomly so that attackers cannot guess at token numbers. The second way is to implement timestamping and synchronization, as in a Kerberos environment. A third way would be to use a timestamped nonce, a random number issued by an authentication protocol that can be used only one time. You can also implement CHAP-based authentication protocols to provide protection against replay attacks.

Session replay attacks occur when an attacker steals a user’s valid session ID and reuses that ID to perform malicious transactions and activities with a web application.

Session hijacking is the exploitation of a computer session in an attempt to gain unauthorized access to data, services, or other resources on a computer.

• session theft
• Tcp/IP hijacking
• Blink hijacking
• Clickjacking
• On-path attack
• Watering hole attack

This is a common type of session hijacking, due to its popularity among attackers. It occurs when an attacker takes over a TCP session between two computers without the need of a cookie or any other type of host access. Because most communications’ authentication occurs only at the beginning of a standard TCP session, an attacker can attempt to gain access to a client computer anytime after the session begins.

TCP

Online game and DNS queries

You should employ encrypted transport protocols such as SSL, IPsec, and SSH.

This type of hijacking occurs when an attacker blindly injects data into a data stream without being able to see whether the injection was successful. The attacker could be attempting to create a new administrator account or gain access to one.

This type of hijacking occurs when a user browsing the web is tricked into clicking something different from what the user thought he or she was clicking. It is usually implemented as a concealed link—embedded code or a script on a website that executes when the user clicks that element.

Man-in-the-middle MITM and man-in-the-browser MITB

These attacks intercept all data between a client and a server. It is a type of active interception. If successful, all communications now go through the MITM attacking computer. The attacking computer can at this point modify the data, insert code, and send it to the receiving computer. This type of eavesdropping is successful only when the attacker can properly impersonate each endpoint.

The trojan infects a vulnerable web browser and modifies web pages and online transactions, in attempt to steal money or data.

Attacker profiles the websites that the intended victim accesses. Scans them for vulns. If a website can be compromised the website is injected with javascript or other code designed to redirect the user when they go to that site. The site usually has exploit code..

is a type of vulnerability in which an attacker lures the targeted user to execute unwanted actions on a web application. Threat-performing XSRF attacks leverage the trust that the application has in the targeted user. For example, the attacker could inherit the privileges of the user to perform an undesired action, such as stealing sensitive information, creating users, or downloading malware.

unlike a CSRF, is initiated from a web server through a vulnerable web application. With a CSRF attack, the user is tricked into doing something that benefits the attacker. In contrast, an SSRF attack is done for the purpose of compromising information from the web server or enabling other attacks, such as bypassing input validation controls or enabling the attacker to execute further commands. As SSRF attack exploits trust relationships.

Standards based web services access protocol developed by Microsoft has been used by numerous legacy applications for many years.

XML

Distributed Component Object Model (DCOM) and Common Object Request Broker Architecture (CORBA)

API that is easier to use than SOAP.

JSON instead of XML.

It uses standards such as Swagger and the OpenAPI Specification (https://www.openapis.org) for ease of documentation and to encourage adoption.

GraphQL is a query language for APIs that provides many developer tools.

Many mobile applications and online dashboards and many different languages support graphql.

HTTP

SOAP limits itself to a stricter set of API messaging patterns than REST.

A roadmap that that describes the underlying implementation of an app.

Security professionals and hackers.

Swagger is a modern framework of API documentation and development that is the basis of the OpenAPI Specification (OAS).

WSDL is an XML-based language that is used to document the functionality of a web service.

WADL is an XML-based language for describing web applications.

Secure API services to only provide HTTPS endpoints with a strong version of TLS.

Validate parameters in the application and sanitize incoming data from API clients.

Explicitly scan for common attack signatures; injection attacks often betray themselves by following common patterns.

Use strong authentication and authorization standards

Use reputable and standard libraries to create the APIs.

Segment API implementation and API security into distinct tiers; doing so frees up the API developer to focus completely on the application domain.

Identify what data should be publicly available and what is sensitive information.

If possible, have a security expert do the API code verification.

Make internal API documentation mandatory.

Avoid discussing company API development (or any other application development) on public forums.

Resource exhaustion attacks are a form of denial-of-service attacks. They can also leverage software vulnerabilities such as memory leaks and file descriptor leaks.

Resource exhaustion is an attack against availability that is designed to bring the network, or access to a particular TCP/IP host/server, to its knees by flooding it with useless traffic.

Botnets

A type of resource leak caused when a program does not release memory properly.

Reduce the performance of a computer.

The memory leak might happen on its own due to poor programming, or it could be that code resides in the application that is vulnerable and is later exploited by an attacker who sends specific packets to the system over the network.

C or C++

Memory debuggers can be used to check for leaks.

Garbage collection libraries.

SSL

1.2

SSL Stripping

An SSL stripping attack occurs when an attacker performs a man-in-the-middle attack and can redirect a client to an insecure HTTP connection. The attacker still establishes a secure HTTPS connection between herself or himself and the server.

Adding a small library that intercepts API calls.

The restructuring of driver code.

A file called the security accounts manager (SAM) file.

NT LAN Manager (NTLM).

NTLMv1 and NTLMv2

Kerberos

When the client is authenticating to a server via IP address or if a client is authenticating to a server in a different Active Directory (AD) forest configured for NTLM trust instead of. transitive inter forest trust.

Because password hashes cannot be reversed, instead of trying to figure out what the user’s password is, an attacker can just use a password hash collected from a compromised system and then use the same hash to log in to another client or server system.

A tool used by many penetration testers, attackers, and even malware that can be useful for retrieving password hashes from memory; it is a useful post-exploitation tool.

A web application vulnerability where an attacker can redirect a user to a malicious site, steal session cookies, or steal other sensitive information.

Application programming interface. Allows other systems to interact with an application.

• Simple object access protocol (SOAP)
• Representational state transfer (REST)
• GraphQL

This standards-based web services access protocol was originally developed by Microsoft and has been used by numerous legacy applications for many years. SOAP exclusively uses XML to provide API services.

XML Schema Definition (XSD) documents

Distributd component object model (DCOM) and Common Object Request Broker Architecture (CORBA).

Is is an API standard that is easier to use than SOAP.

Swagger and the OpenAPI specification for ease of documentation and to encourage adoption.

GraphQL is a query language for APIs that provides many developer tools. GraphQL is now used for many mobile applications and online dashboards, and many different languages support GraphQL.

An API often provides a roadmap that describes the underlying implementation of an application. It also provides API documentation

Swagger is a modern framework of API documentation and development that is the basis of the OpenAPI Specification (OAS).

WSDL is an XML-based language that is used to document the functionality of a web service.

WADL is an XML-based language for describing web applications.

Secure API services to only provide HTTPS endpoints with a strong version of TLS.

Validate parameters in the application and sanitize incoming data from API clients.

Explicitly scan for common attack signatures; injection attacks often betray themselves by following common patterns.

Use strong authentication and authorization standards.

Use reputable and standard libraries to create the APIs.

Segment API implementation and API security into distinct tiers; doing so frees up the API developer to focus completely on the application domain.

Identify what data should be publicly available and what is sensitive information.

If possible, have a security expert do the API code verification.

Make internal API documentation mandatory.

Avoid discussing company API development (or any other application development) on public forums.

Resource exhaustion is an attack against availability that is designed to bring the network, or access to a particular TCP/IP host/server, to its knees by flooding it with useless traffic.

Mimikatz

Driver refactoring

SSL stripping attack

Swagger

clickjacking

Race condition

Adderss space layout randomization (ASLR)

XML External Entity (XXE)