Originally Published on Bugfender

The world is a digital place today. We fulfill most of our work, social, and family tasks virtually, using the internet. The technology is now so universal, with so few barriers to entry, that practically anyone can connect to this global grid, no matter their technical skills.

However, there is a flip side. Many people lack security awareness and knowledge, which can have drastic impacts on their social and financial life. Hackers are becoming ever-more sophisticated, so it is vital that their potential victims keep learning too.

In this article, we will cover five common web applications and cyber security attacks. Even though you’ll already have a lot of technical knowledge, this information will enable you to protect yourself from these threats and maintain a robust, proactive line of defense.

What is a Web Security Attack?

Web security (or web application security) attacks are those activities performed to exploit the weaknesses and vulnerabilities of an application.

Usually, an attack involves two parties: the attacker (criminal) and the victim (user).

Attacker (Criminal)

Figure 1: Representation of an Attacker in this article

These are the people who target a system, user, or account to gain access for illegal purposes. Once they’ve gained access, they steal data, money, credentials, and other essential assets. An attacker could be a human, a program, or a bot, located in any part of the world.

Victim (User)

Figure 2: Representation of a Victim/User in this article

This is the person who is adversely impacted by the attacker. Anyone can fall victim to malicious online activity if they don’t take the necessary precautions; some victims are not particularly internet-savvy, but others possess a significant amount of knowledge. Victims are exposed to their attackers by the exploitable vulnerabilities of the applications they use on a daily basis.

Five Common Web Security Attacks

There are many different kinds of web security attacks. They include:

• SQL Injection Attack
• Man in the Middle Attack
• Broken Access Control
• Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks.
• Malware

Don’t miss part 1 of this web security series, which discussed five other web security attacks. Here is the link.

Web security attacks you must know - Part 1

1. SQL Injection

In an SQL injection attack, an attacker seeks vulnerabilities in the application’s user input validations and database configurations. The attacker injects the malicious queries using the user inputs (like textbox) to execute them on the database.

Once the execution is complete, the attacker can complete several harmful actions including:

• Stealing information.
• Dropping tables (which may allow them to delete essential records).
• Access data that should be off-limits.

The picture below shows the interactions between an attacker and a victim when the SQL injection attack occurs.

Figure 3: The representation of an SQL injection attack

Now let’s look at a couple of examples of SQL injection attacks:

Attack using 1 = 1 kind vector which is always True

Suppose an application retrieves a customer’s account information based on a unique 6-digit PIN. The customer can type the PIN into a textbox and submit it to fetch the information from the database.

Figure 4: User entering a pin and submitting

Let’s assume the PIN input value is passed to a backend service, where we construct an SQL query like this:

const sql = "SELECT * FROM Customers WHERE CustPin = " + inputCustPin;

Now, if an attacker can pass a value like 456789 or 1=1, the SQL statement will look like this:

SELECT * FROM Customers WHERE CustId = 456789 or 1=1;

So the attacker can access information about all the customer’s accounts from the database.

Attack using multiple queries execution

If an attacker is allowed to inject an entire query, the outcome can be extremely serious. It’s as bad as dropping tables, deleting important information, or misconfiguring the database. Most database applications support the execution of multiple queries as a batch.

Let’s consider a case in which the attacker posts the following string as a customer ID value: 456789; DROP TABLE Dept.

Figure 5: Exploiting the batch query execution

The SQL statement will be a valid one and look like this:

SELECT * FROM Customers WHERE CustId = 456789 ; DROP TABLE Dept;

Unfortunately, the above query will remove the entire Dept table from the database.

How to prevent SQL Injection attacks?

• Most SQL injection attacks take place due to a lack of user input validations. So we must ensure that an input field only accepts the correct type of data. For example, an email field must be limited to email ids. We also need to make sure the regular SQL keywords (like DROP) are parsed out from the user inputs wherever possible.
• You can use SQL parameters in the SQL query as a prevention mechanism. These parameters are evaluated at execution time by the SQL engine, which correctly maps the parameters and also validates whether the parameter is suitable for a column.
• It’s important to always perform a scan using a web security tool, so you can assess the state of your application and know what to fix.

2. The ‘Man in the Middle’ Attack

In the Man in the Middle(MITM) attack, the attacker impersonates the legitimate user to steal vital information like login credentials, credit card details, and even more sensitive data.

The victim never realizes that someone is eavesdropping on the sensitive information exchange. Equally, the end system never recognizes the attacker; it believes a legit victim is interacting.

The picture below shows how an attacker performs the role of intermediary in the communication between a victim and the target systems.

Figure 6: The representation of MITM attack

In general, a MITM attacker targets users for financial gain and identity theft. The attacker first intercepts the communication using various spoofing mechanisms like IP and DNS spoofing. After intercepting, the attacker then uses decryption methodologies like SSL Hijacking to make sense of the communication. The last stage of the attack is to pretend to be the victim and gain the advantage of the attack.

How to prevent Man on the Middle attack?

Most Man in the MIddle attacks occurs due to a lack of awareness of security practices. You must make sure to:

• NOT access any website that is not secured. Access sites with protocol HTTPS only.
• NOT connect to a public/open WIFI, especially the password-protected one.
• NOT share your sensitive information with anyone.

3. Broken Access Control

Access control is how you manage user access to your applications, assets, and resources. It would be best to create access rules to define who is supposed to access what and, most importantly, what is not allowed. A Broken Access Control provides attackers ample opportunities to access something they are not supposed to, and then exploit it.

The picture below shows how an attacker got access to the HR database using HR role access privileges. The attacker also got access to a few ADMIN actions using misconfigured APIs.

Figure 7: The representation of Broken Access Control attack

As per OWASP Top 10:2021 list:

“94% of applications were tested for some form of broken access control with [an] average incidence rate of 3.81%, and [this] has the most occurrences in the contributed dataset with over 318k.”

How to prevent Broken Access Control attack?

You can prevent the Broken Access Control problem by making sure of the following:

• Deny all access and then allow what is required.
• Be sure to review and assess the access rights periodically.
• Adhere to the policies while elevating privileges.
• Check and validate CORS configurations.
• Guard the API access using required tokens.

4. Denial of Service(DoS) and Distributed Denial of Service(DDoS) Attack

In Denial of Service(aka DoS), an Attacker targets a computer or any devices to make it unavailable to reach and use. The attacker floods the target system with a vast amount of traffic, so the target system is unable to process it. The target system eventually becomes unavailable to any new users.

An attacker may also choose to slow down the target system instead of making it unavailable. The attacker may consume all the memory in the CPU to cause a memory buffer overflow.

Figure 8: The representation of DoS attack

The Denial of Service(DoS) attack has another known variant called Distributed Denial of Service(DDoS). In a DoS attack, the attacker uses a single connection to the target system to initiate the attack. In the DDoS attack, the attacker uses multiple connections using a botnet to initiate the attack. DDoS is even more common than DOS.

Figure 9: The representation of DDoS attack

How to prevent DoS and DDoS attacks?

To prevent a DoS or DDoS attack, you must first eliminate any doubts and confirm that it is truly an attack. Your application may go sluggish due to a genuine issue, or your website may become unavailable due to a sudden surge of legitimate traffic that you were not prepared for.

However, once you identify the attack, you must try doing the following as a prevention mechanism.

• Rate limiting: this is a way to limit the incoming requests to a server, and helps prevent attackers from lodging a vast number of requests.
• A web application firewall(WAF): this helps monitor traffic between a web app and the internet. It helps protect from DDoS and many other attacks like XSS and SQL Injection.

5. Malware

So, let’s discuss the last attack type, Malware.

Malware, or malicious software, is a program or code that an attacker writes and delivers over a network to infect any target devices.

Malware can come in many forms and types. Some of the well-known types are Worm, Virus, Spyware, Adware, Trojan Horse, Ransomware, Keyloggers, and Backdoor.

Figure 10: The representation of Malware

These attacks are intended to:

• Steal sensitive information
• Spam the target system
• Infect the system to halt essential activities.
• Blackmail the victim and demand money.

How to prevent Malware attacks

To prevent malware you must:

• Install and activate Anti-Virus Software. These tools provide security from various Malware programs.
• Use the tools that come with the operating system comes w(like Windows Defender) to mitigate the risk.

Conclusion

I hope you found the article insightful! We have covered the core details of five major web security attacks. Please read more about these attacks by checking out the following links:

• https://owasp.org/www-project-top-ten/
• https://cheatsheetseries.owasp.org/

---

Let's connect. I share my learnings on JavaScript, Web Development, Career, and Content on these platforms as well,

• Follow me on Twitter
• Subscribe to my YouTube Channel
• Side projects on GitHub