IT 101 – Application Attacks
Welcome to IT 101, where the experts at 2W Tech will tackle a hot topic in the IT industry and break it down for educational purposes.
Among the many types of attacks cybercriminals can use against your organization are application attacks. Attacks on the applications in a networked computer system can be directed toward the server, the client or both. And there are multiple kinds of application attacks your organization should be aware of.
Server-side web application attacks include:
- Cross-site scripting 0- XSS injects scripts into a web application server to direct attacks at unsuspecting clients
- SQL injection – Standing for Structured QUery Language, SQL injection targets SQL servers by introducing malicious commands into them.
- XML injection – Similar to an SQL attack, XML injection is carried out by an attacker who discovers a website that does not filter input user data can inject XML tags and data into the database.
- Directory traversal/command injection – Directory traversal uses malformed input or takes advantage of a vulnerability to move from the root directory to restricted directories. Once the attacker has accessed a restricted directory, she can enter commands to execute on a server called a command injection, or view confidential files.
There are also client-side application attacks that can take down your servers. These occur when target vulnerabilities in client applications interact with a compromised server or process malicious data. These attacks include:
- Header manipulation – This is not an actual attack, but rather the vehicle through which other attacks, such as XSS, can be launched.
- Cookies – Instead of the web server asking the user for the same information each time the site is visited, the server can store user-specific information in a file on the user’s local computer and then retrieve it later.
- Attachments – These are files that are coupled to email messages most commonly used to spread viruses, Trojans, and other malware when they are opened.
- Session hijacking – This is an attack in which an attacker attempts to impersonate the user by using her session token, which is a random string assigned to an interaction between a user and the web application currently being accessed.
- Malicious add-ons – Security risks exist when using add-ons because attackers can create malicious add-ons to launch attacks against the user’s computer.
Don’t let the cybercriminals get the best of your servers via application attacks. Contact 2W Tech today to get started with your Cybersecurity Compliance Program and let our IT Consultants do the work for you.
Read More:
Don’t Let HIPAA Noncompliance Sink Your Business
Manage Office 365 with Office 365 PowerShell