Web-And-CloudSecurity

Web Security
Attack Vectors
Attacks
Tools
Monitoring&Forensic🚧
Cloud Security
Attack Vectors
Tools
Continious Monitoring 🚧

Web Security

Attack Types Descriptions and Tools

Denial of Service (DoS) and Distributed Denial of Service (DDoS)

Description: DoS and DDoS attacks aim to render a machine or network resource unavailable to its intended users by flooding the target or its surrounding infrastructure with excessive internet traffic. Types of DDoS Attacks

  1. Volume-Based Attacks: These attacks flood the target with high volumes of traffic, often using botnets to generate a large number of IP addresses.
  2. Protocol Attacks: Exploiting vulnerabilities in specific protocols like ICMP (Ping Flood), UDP (UDP Flood), or TCP (SYN Flood) to overwhelm the target.
  3. Application Layer Attacks (Layer 7): Targeting application logic directly, using specialized protocols or pseudo-protocols to overload the server.
  4. Resource Exhaustion Attacks: Overloading the target’s resources, such as bandwidth or CPU, to degrade service quality or cause outages.
  5. Reflection Attacks: Using compromised servers to reflect malicious traffic back at the target, amplifying the attack’s impact.

Rescources:

Tools:

Cross-Site Scripting (XSS)

XSS attacks exploit the client-side browser to execute malicious scripts. There are three main forms of XSS attacks: Stored XSS, Reflected XSS, and DOM-Based XSS.

Resources:

Tools:

SQL Injection

SQL Injection attacks involve inserting malicious SQL statements into input fields for execution, potentially leading to unauthorized data access or manipulation.

Resources:

Tools:

CSRF Tokens and Nonces

CSRF tokens and nonces are security measures designed to prevent Cross-Site Request Forgery (CSRF) attacks. These attacks occur when an attacker tricks a victim into performing actions on a web application in which they’re authenticated.

Resources:

Tools:

Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) is a type of vulnerability where an attacker can force a server to make requests to internal systems or external sites. SSRF vulnerabilities arise when a web application allows untrusted input to influence the server’s outbound connections. Attackers can exploit this by sending specially crafted requests that cause the server to connect to internal services or external sites, potentially bypassing firewalls and exploiting internal systems.

Examples of SSRF Attacks

Detection and Prevention

Resources

Tools

Session Hijacking

Session hijacking is a form of cyber attack where an attacker takes over a user’s active session by intercepting and then reusing their credentials, typically in the form of session cookies. Session hijacking exploits the fact that web applications maintain stateful sessions to manage user interactions. When a user logs into a web application, a unique session identifier is generated and stored in a cookie on the user’s device. The server uses this identifier to authenticate the user for subsequent requests. An attacker who intercepts this cookie can assume the identity of the user.

Methods of Session Hijacking

Detection and Prevention

Resources

Tools

Path Traversal

Path traversal vulnerabilities occur when a web application does not properly sanitize user input, allowing attackers to access files and directories outside the intended web root directory. This can lead to unauthorized access to sensitive data, including source code, configuration files, or even executable files. Path traversal vulnerabilities exploit the way web applications handle file paths provided by users. Attackers can manipulate these paths to access resources beyond the web root, leveraging this to read sensitive files, upload malicious files, or execute arbitrary commands.

Examples of Path Traversal Attacks

Detection and Prevention

Tools

Resources

Clickjacking

Clickjacking, also known as UI redress attack, is a malicious technique of deception and confusion for a web user, where fraudulent clicks in a web page are tracked while the user believes they are interacting with another page or element. This can lead to unintended actions being performed, such as clicking on a button that appears to be harmless but actually performs a malicious action. Clickjacking exploits the way web browsers display content from multiple sources in a single page. Attackers embed malicious content over legitimate content, tricking users into performing actions they did not intend to perform.

Examples of Clickjacking Attacks

Detection and Prevention

Tools

Resources

Man-in-the-Middle (MitM) Attacks

A Man-in-the-Middle (MitM) attack is a type of eavesdropping attack where the attacker intercepts and possibly alters the communication between two parties who believe they are directly communicating with each other. MitM attacks can compromise the confidentiality and integrity of the data being transmitted, posing a significant security risk. MitM attacks exploit vulnerabilities in network protocols, encryption mechanisms, or the trust relationship between parties involved in a communication. Attackers position themselves between the sender and receiver to intercept, modify, or store the data being transmitted.

Types of MitM Attacks

Detection and Prevention

Monitoring and Analysis Implement continuous monitoring and analysis of network traffic to detect anomalies that could indicate a MitM attack.

Tools

Resources

Web Cache Poisoning

Web cache poisoning is a specific type of attack targeting web caches, where an attacker inserts malicious content into a cache to serve false information or redirect users to malicious websites. This can lead to phishing, malware distribution, or other forms of cyberattacks. Web cache poisoning exploits vulnerabilities in web caching mechanisms, allowing attackers to corrupt cached content. This can happen through various means, such as manipulating HTTP headers or exploiting weak cache validation mechanisms.

Examples of Web Cache Poisoning Attacks

Detection and Prevention

Tools

Resources

DNS Cache Poisoning

DNS Cache Poisoning is a type of attack where an attacker corrupts a DNS resolver’s cache, causing it to return incorrect IP addresses for domain names. This can lead to users being redirected to malicious websites or having their internet traffic intercepted. DNS Cache Poisoning exploits vulnerabilities in DNS resolver implementations, allowing attackers to inject false DNS records into a resolver’s cache. Once poisoned, the cache serves incorrect IP addresses for legitimate domain names, enabling various types of attacks.

Examples of DNS Cache Poisoning Attacks

Detection and Prevention

Tools

Side Channel & Timing Attacks

Side channel attacks exploit information leaked through the implementation of a cryptosystem or physical implementation to extract data from a system. These attacks focus on the “side effects” of a computation rather than breaking the cryptographic algorithms themselves. Side channel attacks leverage the fact that cryptographic systems often produce observable side effects that can be measured and analyzed. These side effects can include power consumption, electromagnetic radiation, timing, or even sound. By studying these side effects, attackers can gain insights into the internal state of a cryptographic system, potentially revealing secret keys or other sensitive information.

Examples of Side Channel Attacks

RSA Encryption Process

RSA is an asymmetric encryption method based on the difficulty of large integer factorization. It consists of three keys: a public key used for encrypting messages, a private key needed for decrypting them, and optionally a shared key for exchanging messages between two parties.

Timing Attack Against RSA Using the Chinese Remainder Theorem

A timing attack aims to gain information about the secret structure of a system by measuring the time required to perform certain operations. In the context of RSA, such an attack can enable an attacker to discover the system's private keys.

Use of the Chinese Remainder Theorem*

Solution The solution to this system of equations yields the value of x, which corresponds to the private key d. Since the Chinese Remainder Theorem states that a unique solution exists if the pi are pairwise coprime, the attacker can precisely compute d.

Tools

Resources

Local File Inclusion (LFI) & Remote File Inclusion (RFI)

Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities allow attackers to read files from the server’s file system, potentially exposing sensitive data.

Examples of LFI and RFI Attacks

Detection and Prevention

Tools

Resources

Enumeration

lock Enumeration refers to the systematic exploration of an environment to collect information that can be used for subsequent attacks. Almost any potential attack vector originates from improperly configured permissions and the absence of adequate security measures. It’s crucial to ensure that zone forwarding is restricted to specific servers and that DNSSEC is definitely activated. Moreover, no one should be able to probe your critical infrastructure, as these directories should not even be visible to potential attackers.

Targets

Methods

API Abuse

API abuse occurs when an API is misused in ways that were not intended by its creators, often leading to security breaches, denial of service, or unauthorized access to data.

Common types of API abuse

Detection and Prevention Detecting and preventing API abuse requires a combination of monitoring, logging, and implementing security controls.

Resources

Tools