>> Vulnerability risk mitigation part 2.
The learning objectives for this lesson are to
define the different types of web vulnerability attacks,
to explore virtual machine attacks,
and to describe Border Gateway Protocol BGP
or Route Hijacking.
Let's get started. We're going
to start off with web application attacks.
The first attack we're going to
discuss is the directory traversal.
This is also known as file path traversal.
It's a web server vulnerability.
When this vulnerability is present,
this allows the attacker to browse files
that are outside of the web document directory.
This means they have access to the
operating system files themselves.
They're able to read those files,
but they can also write to
those areas of the operating system and this
allows them to upload tools that they
can further compromise the system.
A good example of this is
the Linux /etc/shadow file could now be
red and then the attacker
could collect the password hashes from the system.
Cross-site scripting. This is
similar to directory traversal,
but in cross-site scripting,
it manipulates the file paths.
They control how a web app operates.
A common use for this is when an attacker will
send malicious code to the web app
of the visitor's browser.
This is known as reflected cross-site scripting.
However, stored cross-site scripting inserts
malicious code into the web app itself.
Then when the victim visits then they would receive
the malicious content from the server directly.
Cross-site Request Forgery.
This is an attack that causes the victim to
unintentionally make changes to
their own account and a web app.
Because they made these changes,
now the attacker has access to their account.
A good example of this are the forgot my password links.
The key to remember is false information is sent to
the victim on behalf of the attacker.
This causes the victim to make changes to
their account and now the attacker
has access to the account.
XML and XML external entity injection.
XML is read and then it's processed.
This can lead to many types of attacks such as
directory traversal and code execution attacks.
LDAP injection. This manipulates
LDAP strings to perform malicious actions.
If we have our LDAP server improperly configured,
then these strings could be crafted in a way that allow
an attacker to gain access to the LDAP directory.
They would be able to get information
such as all the user accounts,
all the user information,
and it also insert information
directly into the LDAP directory.
SQL injection.
This manipulates SQL language to gain access to
data in the specifically targeted database.
It is successful against web apps
that take user input and
concatenate it to an SQL command
that is executed against the database.
This would allow for the extraction of records from
a database or for data to be
directly written to the database.
This is a good comic from XKCD.
They all make all kind of comics about all things IT.
But this is a really good one
about why we should sanitize
our data inputs for SQL injection.
Authentication bypass.
This exploits how logins are received
and then how they're processed by
the web application itself.
An example would be sending an SQL string
rather than the log on
credentials that the web app is expecting.
A defense against this would include
input validation and parameterization.
Command injection. This takes
advantage of the web apps that
bypass operating system APIs
and instead will spawn command shells.
This allows for the commands to be
strung together and additional
output given to the attacker
that they wouldn't normally have access to.
The main defense against this would be input validation.
I don't know if you're seeing a pattern here,
but input validation is a big thing
that would prevent many types of attacks.
Process injection. As it's
defined by the MITRE ATT&CK Framework,
this is an attack where the attacker
injects code into a currently running process.
They do this to help evade detection,
but it also could be a prelude to
priviledge escalation. Sandbox escape.
This occurs in web browsers when the code
escapes the safety of
the sandbox that's built into the web browser,
and then the code executes outside of the sandbox.
Defenses for this would be
keeping your browser up-to-date,
limiting the browser add-ons you install,
because many of them could be malicious themselves,
and then also making sure you're not
going to sketchy parts of the Internet.
Virtual machine attacks.
The first one we're going to go over
is virtual machine hopping,
or also known as escaping.
This is an attack against the hypervisor itself and it
allows the attacker to move from one VM to another.
They've already managed to gain access to
one VM running on
the hypervisor and they want to get over to another.
This attack allows them to jump from one to the other.
Defenses for this would be keeping
your VMs patched and fully up-to-date.
Also making sure your hypervisor is updated.
You can also use logical isolation of
the VMs and then resource limits.
Network attacks. VLAN hopping.
This allows an attacker to move
between isolated networks or VLANs.
It usually happens when we spoof a switch and I
switched environment and allows
us to move from one village to another.
Another type of attack is called double tagging.
This is where trunking is taken advantage of so that
we can gain access to all VLAN traffic.
Defenses against both of these
include changing your default VLAN IDs,
never leave default settings,
and also the user devices should not
be connected to the native VLAN.
Border Gateway Protocol, BGP or route hijacking.
BGP is the routing protocol of the Internet.
It was created back in the day
when security wasn't a consideration.
Because of that, it depends
on the interconnected networks
to all truthfully and
accurately help maintain the routing tables.
Defenses against these types of attacks include
IP prefix filtering and also
monitoring traffic for abnormal behavior.
Now, instructor side note,
BGP hijacking is a big deal.
From 2015-2017, China diverted
all US domestic Internet communications and routed it
through China before it went
onto their proper destinations.
Then again in 2019,
China diverted a large amount of
the European data for a period of up to two hours.
In 1998, the hacker group L0pht testified to
Congress that they could take down
the Internet in less than 30 minutes using BGP.
This is one of those protocols that
we have really no good way
of defending against because security
was never built into it from the beginning.
Just keep a note of this,
that BGP hijacking is a big deal.
It has huge and wide-ranging ramifications.
Then, finally, let's go over some
other types of attacks.
Interception attacks.
These are any unauthorized access to network traffic.
Defenses for these would be access controls,
but also traffic encryption.
Denial-of-service, or
distributed denial-of-service attacks.
These are attacks against the availability of a website
or a service by sending too much data
to it for that service to process.
Defenses include using
DDoS mitigation services like Cloudflare.
Also social engineering.
This is using human nature against
users by using their emotions such as fear
or there need to be helpful
to get them to do things that they wouldn't normally do.
Defenses include training, and also limiting user
access to unnecessary services or data.
If they don't need to have access to it,
we shouldn't give them access to it.
Let's summarize. We discussed
common web application attacks.
We also went over virtual machine attacks and
VLAN hopping and then we also
discussed BGP or route hijacking.
Let's do some example questions.
Question 1. This is an attack against
a hypervisor in order to move from one VM to another.
VM hopping. Question 2.
This protocol is the routing protocol of
the Internet and wasn't designed with security in mind.
Border Gateway Protocol. Question 3.
This is considered one of the
hardest attack types of defends
against as it uses human nature against users.
Social engineering. Finally question 4.
This type of attack manipulates data inputs to a database
to either retrieve protected data or bypass permissions.
SQL Injection.
I hope this lesson was helpful
for you, and I'll see you in the next one.