SQL injection A classification of SQL injection attacking vector as of 2010. SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. In a 2012 study, it was observed that the average web application received 4 attack campaigns per month, and retailers received twice as many attacks as other industries. History The first public discussions of SQL injection started appearing around 1998; for example, a 1998 article in Phrack Magazine. Form SQL injection (SQLI) is considered one of the top 10 web application vulnerabilities of 2007 and 2010 by the Open Web Application Security Project. In 2013, SQLI was rated the number one attack on the OWASP top ten. There are four main sub-classes of SQL injection: 1;DROP TABLE users
Denial-of-service attack DDoS Stacheldraht Attack diagram. Perpetrators of DoS attacks typically target sites or services hosted on high-profile web servers such as banks, credit card payment gateways, and even root nameservers. DoS threats are also common in business, and are sometimes responsible for website attacks. This technique has now seen extensive use in certain games, used by server owners, or disgruntled competitors on games, such as server owners' popular Minecraft servers. Denial-of-service attacks are considered violations of the Internet Architecture Board's Internet proper use policy, and also violate the acceptable use policies of virtually all Internet service providers. Symptoms and manifestations The United States Computer Emergency Readiness Team (US-CERT) defines symptoms of denial-of-service attacks to include: Methods of attack A denial-of-service attack is characterized by an explicit attempt by attackers to prevent legitimate users of a service from using that service.
Cross-site scripting Background Security on the web is based on a variety of mechanisms, including an underlying concept of trust known as the same origin policy. This essentially states that if content from one site (such as is granted permission to access resources on the system, then any content from that site will share these permissions, while content from another site ( will have to be granted permissions separately. Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug-in systems on which they rely. XSS vulnerabilities have been reported and exploited since the 1990s. Types There is no single, standardized classification of cross-site scripting flaws, but most experts distinguish between at least two primary flavors of XSS: non-persistent and persistent. Non-persistent A reflected attack is typically delivered via email or a neutral web site. Persistent Exploit examples
Anonymous (group) Anonymous (used as a mass noun) is a loosely associated international network of activist and hacktivist entities. A website nominally associated with the group describes it as "an internet gathering" with "a very loose and decentralized command structure that operates on ideas rather than directives". The group became known for a series of well-publicized publicity stunts and distributed denial-of-service (DDoS) attacks on government, religious, and corporate websites. Anonymous originated in 2003 on the imageboard 4chan, representing the concept of many online and offline community users simultaneously existing as an anarchic, digitized global brain. Anonymous members (known as "Anons") can be distinguished in public by the wearing of stylised Guy Fawkes masks. In its early form, the concept was adopted by a decentralized online community acting anonymously in a coordinated manner, usually toward a loosely self-agreed goal, and primarily focused on entertainment, or "lulz".
Internet Relay Chat Internet Relay Chat (IRC) is an application layer protocol that facilitates transfer of messages in the form of text. The chat process works on a client/server model of networking. IRC clients are computer programs that a user can install on their system. Client software is available for every major operating system that supports Internet access. As of April 2011, the top 100 IRC networks served more than half a million users at a time, with hundreds of thousands of channels operating on a total of roughly 1,500 servers out of roughly 3,200 servers worldwide. Over the past decade IRC usage has been declining: since 2003 it has lost 60% of its users (from 1 million to about 400,000 in 2014) and half of its channels (from half a million in 2003). History  Technical information A screenshot of HexChat, an IRC client for GTK environments. Xaric, a text-based IRC client, in use on Mac OS X. IRC is an open protocol that uses TCP and, optionally, TLS. Modes
Cold boot attack Description The attack has been demonstrated to be effective against full disk encryption schemes of various vendors and operating systems, even where a Trusted Platform Module (TPM) secure cryptoprocessor is used. This is because the problem is fundamentally a hardware (insecure memory) and not a software issue. Compressed air cans can be improvised to cool memory modules, and thereby slow down the degradation of volatile memory With certain memory modules, the time window for an attack can be extended to hours by cooling them with a refrigerant such as an inverted can of compressed air. This is not the only attack that allows encryption keys to be read from memory—for example, a DMA attack allows physical memory to be accessed via a 1394 DMA channel. Mitigations Full memory encryption Dismounting encrypted disks Most disk encryption systems overwrite their cached encryption keys as encrypted disks are dismounted. Advanced encryption modes Booting 
DMA attack A DMA attack is a type of side channel attack in computer security, in which an attacker can penetrate a computer or other device, by exploiting the presence of high-speed expansion ports that permit Direct Memory Access ("DMA"). Preventing physical connections to such ports will prevent DMA attacks. On many computers, the connections implementing DMA can also be disabled within the BIOS or UEFI if unused, which depending on the device can nullify or reduce the potential for this type of exploit. Description In modern operating systems, non-system (i.e. user-mode) applications are prevented from accessing any memory locations not explicitly authorized by the virtual memory controller (called Memory Management Unit (MMU)). Uses An attacker could, for example, use a social engineering attack and send a "lucky winner" a rogue Thunderbolt device. There is a special tool called Inception for this attack, only requiring a machine with an expansion port suspectible to this attack.
Ping flood A flood ping can also be used as a diagnostic for network packet loss and throughput issues. References Jump up ^ See also External links "TBTF for 8/4/97: A morbid taste for fiber" by Keith Dawson SYN flood A normal connection between a user (Alice) and a server. The three-way handshake is correctly performed. SYN Flood. The attacker (Mallory) sends several packets but does not send the "ACK" back to the server. The connections are hence half-opened and consuming server resources. Technical details The client requests a connection by sending a SYN (synchronize) message to the server.The server acknowledges this request by sending SYN-ACK back to the client.The client responds with an ACK, and the connection is established. This is called the TCP three-way handshake, and is the foundation for every connection established using the TCP protocol. A SYN flood attack works by not responding to the server with the expected ACK code. Countermeasures There are a number of well-known countermeasures listed in RFC 4987 including: FilteringIncreasing BacklogReducing SYN-RECEIVED TimerRecycling the Oldest Half-Open TCPSYN CacheSYN cookiesHybrid ApproachesFirewalls and Proxies See also
Smurf attack The Smurf Attack is a distributed denial-of-service attack in which large numbers of Internet Control Message Protocol (ICMP) packets with the intended victim's spoofed source IP are broadcast to a computer network using an IP Broadcast address. Most devices on a network will, by default, respond to this by sending a reply to the source IP address. If the number of machines on the network that receive and respond to these packets is very large, the victim's computer will be flooded with traffic. This can slow down the victim's computer to the point where it becomes impossible to work on. History In the late 1990s, many IP networks would participate in Smurf attacks if prompted (that is, they would respond to ICMP requests sent to broadcast addresses). Mitigation The fix is two-fold: Configure individual hosts and routers to not respond to ICMP requests or broadcasts; orConfigure routers to not forward packets directed to broadcast addresses. Mitigation on a Cisco Router