CCT: Application Attacks

Injection Flaws

Injection flaws are web application vulnerabilities that allow untrusted data to be interpreted and executed as part of a command or query. They are consistently ranked among the most dangerous web vulnerabilities.

Results of successful injection attacks:

• Data loss or corruption
• Unauthorized access to sensitive configuration
• Denial of access to legitimate users
• Exposure of internal system details

Common injection types:

Vulnerable SQL:
SELECT * FROM users WHERE username = '[INPUT]'

Injected Input: ' OR '1'='1
Result: SELECT * FROM users WHERE username = '' OR '1'='1'
--> Returns all users

Cross-Site Scripting (XSS)

XSS attacks exploit vulnerabilities in dynamically generated web pages by injecting client-side scripts that execute in other users' browsers.

XSS occurs when unvalidated (unsanitized) input is included in dynamic content sent to a user's browser for rendering. The browser trusts the content because it appears to come from a legitimate site.

Attack Flow:
Attacker injects malicious script into web application
         |
Victim visits the page
         |
Browser executes the injected script in the victim's context
         |
Attacker receives stolen session tokens or credentials

Parameter Tampering

Parameter tampering involves manipulating the parameters exchanged between client and server to modify application data, such as:

• User credentials and permission levels
• Product prices and quantities
• Session identifiers and access tokens

Tool commonly used: Burp Suite

Directory Traversal Attacks

In directory traversal attacks, attackers use the ../ (dot-dot-slash) sequence to navigate outside the web server root directory and access restricted files.

http://server.com/script/..%5c../Windows/System32/cmd.exe?/c+dir+c:\

By chaining multiple ../ sequences, attackers can reach sensitive files like /etc/passwd on Linux systems or system configuration files on Windows.

DNS Amplification Attack

Attackers abuse the DNS recursive lookup mechanism to amplify attack traffic. A small request to a DNS resolver returns a much larger response. By spoofing the source IP as the victim's IP, all amplified responses are directed toward the victim.

Application-Level DoS Attacks

Unlike network-layer DoS attacks that flood bandwidth, application-level DoS attacks exhaust server resources by sending hundreds of resource-intensive requests:

• Retrieving large image files
• Requesting pages that require expensive database searches
• Initiating costly cryptographic operations

Cross-Site Request Forgery (CSRF)

CSRF exploits web page vulnerabilities that allow an attacker to force a victim's browser to send malicious requests the victim did not intend.

Attack Flow:
1. Victim has an active authenticated session with trusted-site.com
2. Victim visits attacker-controlled malicious site
3. Malicious site injects HTTP request targeting trusted-site.com
4. Victim's browser sends request with the active session cookie
5. Trusted site processes the request as if it came from the victim

CSRF compromises the integrity of user sessions without stealing credentials.

Server-Side Request Forgery (SSRF)

SSRF causes a vulnerable server to make requests to internal resources or external systems on the attacker's behalf.

XXE (XML External Entity) is a related attack where a misconfigured XML parser processes external entity references embedded in malicious XML input, enabling access to protected files and internal services.

Watering Hole Attack

A watering hole attack involves compromising a website that the target organization's employees frequently visit. When victims visit the infected website, they are redirected to a malicious server, and malware is downloaded to their machines.

Analogy: A predator waits near a watering hole for prey to arrive.

Attack Pattern:
Attacker identifies sites frequently visited by target
         |
Attacker compromises those sites
         |
Target employees visit compromised site
         |
Malware downloaded, machine compromised
         |
Attacker gains access to target organization's network

Session Hijacking and Session Replay

In a session replay attack, the attacker captures an authentication token from a session between a user and a server, then replays it to gain unauthorized access.

1. Attacker monitors communication (via sniffing or MITM)
2. Authentication token captured
3. Attacker replays token to server
4. Server grants access as if it were the legitimate user

API Attacks

APIs are increasingly targeted as they expose application logic and data directly. Common API attack types:

SSL Stripping

SSL stripping (also called SSL downgrading) demotes a connection from HTTPS to unencrypted HTTP. This exposes the user's communication to eavesdropping and manipulation, forcing redirects to an attacker-controlled HTTP server.

Normal:
User --> HTTPS --> Legitimate Server (encrypted)

SSL Stripped:
User --> HTTP --> Attacker --> HTTPS --> Legitimate Server
         (cleartext)          (encrypted to server)

Malicious Code Execution

PowerShell is frequently used in fileless malware attacks. Attackers integrate malicious code into running applications using PowerShell scripts, taking advantage of its deep access to Windows internals.

Python is used by script kiddies who download exploit scripts from open-source platforms to attack exposed servers, applications, and webpages.

Password Cracking

Password cracking is used to gain unauthorized access to systems protected by single-factor authentication. Most cracking techniques succeed because of weak or easily guessable passwords.

Pass-the-Hash (PtH) Attack

In a Pass-the-Hash attack, the attacker injects a compromised credential hash into a local session and uses that hash to authenticate to network resources — without needing to crack the actual password.

1. Attacker extracts NTLM hash from compromised system
2. Hash is injected into a new authentication session
3. Attacker authenticates to domain controller using the hash
4. Full domain access achieved without knowing the plaintext password

Buffer Overflow

A buffer overflow occurs when a program accepts more data than the allocated buffer can hold, overwriting adjacent memory regions.

Normal Buffer:
[    BUFFER    ][    ADJACENT MEMORY    ]
  [DATA FITS]

Overflow:
[    BUFFER    ][    ADJACENT MEMORY    ]
  [DATADATADATADATADATA-->OVERFLOW-->]
                          ^
                    Malicious code injected here

Successful buffer overflow exploitation can:

• Inject and execute malicious code
• Modify program data
• Access critical information
• Escalate privileges
• Gain shell access

Root causes:

• Lack of boundary checking
• Use of unsafe C functions (gets, strcpy)
• Poor input sanitization
• Improper memory allocation

Privilege Escalation

After gaining initial access, attackers attempt to acquire higher-level privileges.

DLL Hijacking and Injection

Most Windows applications do not use fully qualified paths when loading external DLL libraries. If an attacker can place a malicious DLL in the application directory, it will be loaded instead of the legitimate library.

Tools that identify hijackable DLLs: Robber, PowerSploit

Driver Manipulation

Attackers can make device drivers malicious through two techniques:

Refactoring modifies the non-functional parts of driver software without changing its actual operation. By altering control blocks, variables, and internal structures, attackers hide malicious code within legitimate drivers to evade antivirus solutions.

Application Shimming uses Windows compatibility shims (designed to allow older software to run on newer Windows versions) as attack vectors. Shims like RedirectEXE, injectDLL, and GetProcAddress can be abused to:

• Escalate privileges
• Install backdoors
• Disable Windows Defender