Application Attacks - CompTIA Security+ SY0-701 - 2.4

Main ideas, concepts, and lessons

1) Application injection attacks (malicious input inserted into an app)

• Core concept: Injection attacks are common because an attacker can provide malicious code as input to a server/client process that normally expects benign input.
• When they succeed: They work especially when an application does not properly validate/check input.
• Example types mentioned:
  • SQL injection
  • HTML injection
  • XML injection
  • LDAP injection
  • (General note: other data-type injections exist beyond the listed ones)

---

2) Buffer overflow (overwriting adjacent memory)

• Core concept: A buffer overflow happens when data is written into a memory area (buffer) reserved for a variable, but the input is too large, so extra data “overflows” into adjacent memory.
• Why it’s possible: Enabled when the application fails to validate input size and performs insufficient checks.
• Attacker outcomes:
  • Often causes the application to crash (not useful to attacker).
  • If an attacker finds a buffer overflow that is repeatable and consistent, it can become a powerful exploit.
• Complexity note: Exploits can be difficult because memory layout and behavior vary by application.

---

3) Replay attacks (reusing captured authentication/session data)

• Core concept: An attacker captures information and then replays it to the server to gain access.
• Key challenge: The attacker must find useful data that can be replayed.
• How data may be captured:
  • Network capture via a network tap
  • ARP poisoning
  • Malware on the victim’s computer
• What may be replayed:
  • Username and password hash
  • Session ID
• Attack chaining mentioned: Use an on-path attack to capture info, then use replay to submit it.

---

4) Privilege escalation (gaining higher permissions)

• Core concept: When a user logs in, they receive permissions appropriate to their role.
  • Normal users typically should not get administrator-level access.
  • Attackers try to obtain elevated rights by exploiting vulnerabilities/bugs.
• Two types described:
  • Vertical privilege escalation: reaching administrator (highest typical level).
  • Horizontal privilege escalation: moving from a user to another user’s level (not admin, but beyond what the attacker should access).

Defensive actions / methodology (explicit steps)

1. Patch and close vulnerabilities
   • Patch the application/software so the exploit path no longer exists.
2. Update antivirus/anti-malware
   • Update especially signatures (referred to as “signature FEs” in the subtitles) to detect known exploit attempts targeting this escalation type.
3. Use OS-level memory protections
   • Data Execution Prevention (DEP): restricts which memory areas executables can run in; may block exploits executing in non-permitted memory regions.
   • Address space/layout randomization (ASLR-like behavior): randomizes where data is stored in memory so exploits are harder to locate reliably.

• Example vulnerability cited:
  • CVE-2023-29336
  • A Win32k elevation of privilege flaw
  • Announced May 2023
  • Affected Windows components/versions including:
    • Windows Server: 2008, 2008 R2, 2012, 2012 R2, 2016
    • Windows 10
  • Impact if exploited: attacker gains system privileges (highest privilege in Windows).

---

5) Cross-site request attacks (CSRF/XSRF “one-click” / “session riding”)

• Core concept: Websites commonly load content from many sources, and code runs in different places:
  • Client-side code (browser): commonly HTML/JavaScript
  • Server-side code (web server): handles backend actions (e.g., processing transfers, posting content)

CSRF idea

Attack exploits the fact that:

• A user is already authenticated to a trusted site
• The site trusts the user’s browser

• The attacker tries to make the browser perform actions on the attacker’s behalf without the user’s awareness

• Common names/acronyms mentioned:

  • XSRF/CSRF
  • Also described as “one-click” and session riding

Antiforgery control mentioned

• Use a cryptographic token tied to requests/transactions
• Server verifies both:
  • proper authentication
  • correct token for that specific transaction

Attack example (step-by-step)

1. Attacker creates a funds transfer request.
2. Attacker embeds/places it so it can be sent via the victim’s browser (e.g., through a malicious hyperlink in email or a message).
3. Victim clicks the link while already logged into their bank.
4. Browser automatically sends necessary request elements to the bank behind the scenes.
5. Transfer occurs; victim may not realize it happened.

---

6) Directory traversal (web server misconfiguration/vulnerability)

• Core concept: Not strictly an “application vulnerability” but a web server configuration vulnerability (or server software/app weakness) that allows attackers to read/write files outside the intended web root.

How misconfiguration enables it

• The web server should restrict access to files within the site directory (e.g., “web root”).
• If misconfigured, attacker may access other system directories (e.g., Windows/system folders).

Software vulnerability variant

• Even if server config is correct, a web server software vulnerability may allow traversal using crafted input.
• An application on that server could also help the attacker write outside permitted areas.

Detection example described

• Web server logs may show traversal attempts using patterns like ../ (“dot dot slash”), e.g. references to sensitive files such as system.ini.
• In the described example, attackers try to move “backwards” one directory to reach outside the intended scope.

---

Speakers / sources featured

• Professor Messer (referenced as the website professormesser.com)
• YouTube (referenced as a content source loaded by websites)
• Instagram (referenced as a content source loaded by websites)
• Facebook (referenced as an example target site for CSRF)
• Bank website (referenced as the example target application in the CSRF scenario)
• CVE-2023-29336 / Windows Win32k (named vulnerability source)
• Windows Server / Windows 10 (platforms referenced)