Common web vulnerabilities
Cross-site scripting attacks
Description
Cross-site scripting (XSS) is a type of attack that typically occurs on the client side. It can be used to compromise user privacy, conduct phishing scams, steal passwords, and spread malicious code. XSS attacks primarily use HTML and JavaScript scripts, but can also involve VBScript and ActionScript.
An attacker typically stores malicious code in a web page on a server. When a user visits that web page, the malicious code is injected into the user's browser and executed. During this process, the attacker can steal session cookies to obtain the user's private information, including sensitive information such as passwords.
Impacts
XSS attacks do not directly harm the web server. However, they can spread through a website to attack its users and steal their private information. This can cause significant damage to the website. XSS attacks can have the following impacts:
Phishing scams: Attackers can exploit a reflected cross-site scripting vulnerability on a target website to redirect users to a phishing website. They can also inject a phishing JavaScript script to monitor form input on the target website or launch more advanced phishing attacks based on DHTML technology.
Website trojan attacks: An attacker can use an Iframe tag to embed a hidden malicious website. When a user visits the compromised website, they are redirected to the malicious website or see pop-ups from it.
Identity theft: An XSS attack can steal a user's cookie to take over the user's operation permissions for that website. If an attacker steals the cookie of a website administrator, they can cause significant damage to the website.
Theft of private user information: When an attacker steals a user's identity and obtains their operation permissions, the user's private information is also exposed.
Sending spam: Using an XSS attack, an attacker can use the victim's identity on a social networking site to send large amounts of spam to specific groups.
Hijacking user web behavior: Through advanced XSS attacks, an attacker can monitor a user's browsing history and the data they send and receive.
XSS worms: Using XSS worms, attackers can perform malicious activities, such as advertising, generating fake traffic, planting trojans, disrupting services, destroying online data, and launching DDoS attacks.
CRLF injection attacks
Description
An HTTP response splitting vulnerability is also known as a CRLF injection attack, named for the carriage return (CR) and line feed (LF) characters.
An HTTP header consists of multiple lines separated by a CRLF combination, where each line has a "key: value" structure. By injecting CRLF characters, an attacker can manipulate the HTTP header structure.
Impacts
An attacker can inject custom HTTP header information, such as session cookies or HTML code. This allows the attacker to perform cross-site scripting (XSS) or session fixation attacks.
SQL injection attacks
Description
SQL injection is a security vulnerability that occurs at the database layer of an application. It is a common attack vector used to illegally gain control of websites.
If an application does not validate input strings for embedded SQL instructions, the database may mistake malicious SQL instructions submitted by an attacker for legitimate instructions and execute them. This can lead to the database being attacked, data being stolen, modified, or deleted. It can also result in the website being embedded with malicious code or having a back door installed.
Impacts
SQL injection attacks can have the following impacts:
Theft of confidential data.
Tampering of core business data.
Tampering of web pages.
The database server is attacked and turned into a puppet host, which can lead to the compromise of the entire corporate network.
WebShell attacks
Description
In a WebShell attack, an attacker uploads a malicious script, known as a WebShell, to a web server to gain control over it.
Impacts
After uploading a WebShell back door to a website, an attacker can manipulate files and execute commands on the web server.
Local file inclusion
Description
A Local File Inclusion (LFI) vulnerability occurs when an application includes a file without correctly validating the input. This allows an attacker to trick the application into executing code from local files on the server, such as uploaded static files or website log files.
Impacts
An attacker can exploit this vulnerability to execute commands on the server and obtain server permissions. This can lead to further malicious activities, such as the malicious deletion of the website or the tampering of user and transaction data.
Remote file inclusion
Description
A Remote File Inclusion (RFI) vulnerability occurs when an application includes a remote file without correctly validating the input. This allows an attacker to trick the application into including and executing malicious code from a remote server.
Impacts
An attacker can exploit this vulnerability to execute commands on the server and obtain server permissions. This can lead to further malicious activities, such as the malicious deletion of the website or the tampering of user and transaction data.
Remote code execution
Description
Remote Code Execution (RCE), also known as code injection, is a critical security vulnerability. It occurs when a server-side vulnerability allows malicious code to be executed on the server.
Impacts
An attacker can exploit this vulnerability to execute arbitrary code on the server.
FastCGI attacks
Description
The FastCGI protocol is used to pass requests between a web server and an application to improve the processing performance of dynamic content. However, an improper implementation or configuration of FastCGI can lead to the following vulnerabilities:
Unauthorized access: If the FastCGI process listens on an insecure network interface, an attacker can communicate with it directly. Unencrypted communication and a lack of identity verification can allow an attacker to send malicious requests.
Code injection: If FastCGI parameters are not properly filtered or validated, an attacker can inject malicious code, which may lead to a code execution vulnerability.
Resource exhaustion: An attacker can send many requests to exhaust FastCGI process resources. This causes requests from legitimate users to be rejected and degrades service performance.
Impacts
Information leakage: An attacker can obtain sensitive information, such as database credentials, user data, and server configurations. This information can be used for further attacks.
Denial-of-service (DoS): By consuming server resources, an attacker can make the service unavailable. This affects business continuity.
Arbitrary code execution: An attacker can execute arbitrary code on the server. This can lead to a data breach, data tampering, or even full control of the target server.